Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain

This threat involves a widespread compromise of thousands of small-business websites that serve ClickFix malware payloads. The payloads are stored in smart contracts on the BNB Smart Chain (BSC), a blockchain platform, allowing attackers to distribute malicious code in a decentralized manner. This method leverages blockchain's immutability and distributed nature to resist takedown and detection. The campaign represents a novel approach to malware hosting and delivery, combining website compromise with blockchain technology.

The compromised websites serve malicious payloads that can infect visitors, potentially leading to unauthorized access, data theft, or further malware deployment. The use of blockchain to store payloads complicates detection and remediation, as the malicious code is hosted on an immutable decentralized platform. This increases the persistence and resilience of the malware delivery mechanism, posing a significant challenge to defenders.

No specific patch or vendor advisory is available for this threat. Mitigation should focus on securing vulnerable websites to prevent compromise, including applying security best practices for website management and monitoring for unauthorized changes. Due to the blockchain-based hosting of payloads, traditional takedown methods are less effective. Organizations should also educate users about the risks of visiting compromised sites and consider network-level protections to block known malicious domains or payload sources. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.