How the Blockchain Malware Campaign Compromises Over 5,400 Sites

The latest telemetry from cloud-security firm Netskope confirms a blockchain malware campaign that has infected more than 5,400 web properties. Most victims are small-business WordPress and PrestaShop installations that silently fetch a ClickFix payload from smart contracts deployed on the BNB Smart Chain (BSC) Testnet. The payload presents a fake CAPTCHA, urges the visitor to run a PowerShell command, and executes the malicious code entirely in memory. The campaign was first reported on September 5, 2026 by Bill Toulas and is documented on the original source page.

Evolution from Static Binary to WebRTC Data-Channel Stager

Early versions of the injector downloaded a static ClickFix binary stored in a BSC Testnet contract. In mid-2026 the operators upgraded the delivery mechanism to a WebRTC data-channel stager. This stager establishes a peer-to-peer connection, fabricates a session description answer, and opens an encrypted data channel to a hard-coded command-and-control server. JavaScript received over the channel is injected into the page’s DOM head and executed in memory, leaving no file artifacts on disk. Netskope records show 300+ active infected sites per day, with RPC calls to the testnet rising from roughly 400 in August to a peak of 536.

Why Testnet Weaponization Threatens Web3 Infrastructure

Using a public testnet as a distribution layer creates three concrete risks:

  1. Free developer resources become a low-cost C2 backbone – testnet nodes are open, unmetered, and globally reachable.
  2. Outbound RPC traffic turns corporate networks into inadvertent relays – compromised servers issue unauthenticated JSON-RPC calls that can bypass traditional egress filters.
  3. Service providers face pressure to implement granular firewall rules – without safe-list RPC endpoints, providers must block large swaths of traffic, potentially impacting legitimate developers.
    Enterprises should treat blockchain RPC endpoints as high-risk egress points and enforce strict outbound controls.

Regulatory Landscape and Compliance Implications

Regulators are tightening scrutiny of blockchain-enabled illicit activity. The U.S. Treasury’s OFAC and the EU’s AMLD5 now include guidance on blockchain-based money-laundering vectors. Although the current campaign focuses on malware delivery, the same technique could be repurposed to exfiltrate credentials or private keys, triggering mandatory reporting obligations for affected firms under both U.S. and EU frameworks.

Actionable Defense Steps for Security Teams

  1. Block BSC Testnet RPC endpoints – Deploy Netskope’s curated deny list or equivalent firewall rules.
  2. Monitor outbound UDP traffic on ports 3478-3480 – Look for patterns consistent with WebRTC handshakes.
  3. Enforce least-privilege web-server credentials – Regularly patch plugins and rotate passwords.
  4. Deploy Content-Security-Policy script blockers – Restrict script-src to trusted domains only.
  5. Integrate threat-intel feeds – Feed Netskope IOCs into SIEMs for real-time alerts.
  6. Review internal development policies – Avoid hard-coding testnet endpoints in production code.

Broader Threat Context: Hybrid Attacks Merging Web3 and Classic Exploits

The blockchain malware campaign mirrors a growing class of hybrid attacks where decentralized persistence meets traditional phishing lures. Ransomware groups have stored decryption keys on immutable ledgers, and supply-chain attacks have embedded malicious contracts into open-source registries. This convergence creates a new threat model that blends Web3 persistence with classic web-application exploits, expanding the attack surface for both developers and defenders.

What to Watch Next: Emerging Testnet Targets and Stager Enhancements

Analysts predict threat actors will shift to other testnets such as Ethereum’s Goerli or Polygon’s Mumbai to evade emerging blocklists. Future iterations may upgrade the WebRTC stager to support encrypted file exfiltration, turning compromised browsers into data-stealing proxies. Organizations should therefore monitor not only RPC traffic but also anomalous WebSocket and WebRTC connections originating from public-facing servers.

Industry Response and Best-Practice Recommendations

Security vendors are updating signatures. Netskope’s advisory recommends immediate blocking of BSC testnet nodes and adding relevant IOCs to detection rules. The Web3 ecosystem board notes that developers should avoid hard-coding testnet endpoints in production code, as this practice inadvertently facilitates abuse.

Adapting Defenses to a Decentralized Threat Landscape

The scale of this blockchain malware campaign—over 5,400 sites delivering blockchain-hosted payloads—demonstrates that attackers can achieve persistent, low-cost distribution by leveraging public testnets. Defensive postures must adapt, treating blockchain RPC endpoints as high-risk egress points and tightening web-application hygiene. As decentralized infrastructure and traditional cyber-crime continue to merge, vigilance across both domains becomes essential.

Explore more on this topic