A cybercriminal campaign is using compromised small-business websites to deliver malware through payloads stored in smart contracts on the BNB Smart Chain Testnet, according to BleepingComputer, which cites research from Netskope. The report says researchers identified more than 5,400 hacked websites over the past months, with most of them built on WordPress and PrestaShop. The initial compromise method remains unknown from the reporting, but the observed sites were injected with a script that contacted BSC Testnet remote procedure call endpoints to retrieve the next-stage payload. The technique is known as EtherHiding: attackers place malicious code or configuration data inside blockchain smart contracts rather than on conventional hosting infrastructure. In this case, BleepingComputer reports, the actors used the BSC Testnet, which Netskope described as a developer-oriented network that works similarly to BNB’s production blockchain but can be used free of charge. The user-facing lure was ClickFix. Visitors saw a fake CAPTCHA-style prompt and were instructed to open the Windows Run dialog and paste a PowerShell command. If followed, that command downloaded and executed the final payload on the victim’s machine. The blockchain component matters operationally because the attacker can change what the compromised website retrieves from the smart contract. BleepingComputer reports that, later in the campaign, the actor swapped the ClickFix payload for a WebRTC data-channel stager. In that newer variant, the payload creates a peer connection and data channel, then uses a self-generated answer to open a channel back to the attacker rather than completing a normal handshake with a remote peer, according to Netskope’s explanation as summarized by BleepingComputer. The stager receives JavaScript from a hardcoded command-and-control address, buffers it, and executes it when the channel closes or after ten seconds. Netskope’s telemetry indicates the campaign remains active at scale. BleepingComputer reports that the operation uses more than 300 infected websites per day; since spring, the number of compromised sites contacting BSC Testnet RPC endpoints has grown, reaching nearly 400 per day in August and an all-time peak of 536. For defenders, the reported recommendations are concrete: block the pool of BSC Testnet RPC endpoints identified by the researchers and monitor for non-web User Datagram Protocol traffic associated with WebRTC. The reporting does not identify the threat actor or explain how the websites were initially compromised, which leaves two important parts of the intrusion chain unresolved. Who benefits: Attackers benefit from infrastructure that can be updated centrally and is harder to disrupt. Defenders get useful detection points if they can monitor BSC Testnet RPC access and unusual WebRTC-related UDP traffic. Who's exposed: Owners of WordPress and PrestaShop sites are exposed if their sites are compromised and used as delivery nodes. Windows users are exposed when fake CAPTCHA prompts persuade them to run PowerShell commands manually.