EtherHiding Campaign Targets 5,400+ Compromised Sites with WebRTC-Based C2
Summary
Netskope reports an EtherHiding campaign using BSC testnet contracts to deliver malware through more than 5,400 compromised sites. A newer variant forges a WebRTC answer to open a covert C2 channel without signaling traffic.
Key points
- Netskope observed more than 5,400 compromised websites across 2,200+ organizations; hundreds were active on a typical day, and activity is increasing.
- Injected scripts on affected sites make JSON-RPC calls to BSC testnet smart contracts to retrieve and run changing payloads. How the sites were initially compromised is unknown.
- The commonly observed chain delivers a ClickFix overlay that tells visitors to run a command, which downloads and executes the final payload.
- A newer variant forges its own WebRTC session answer, hardcoding connection details to open an encrypted data channel without the usual signaling exchange.
- The stager executes code received over the channel in the browser without writing it to disk, reusing a page script's Content Security Policy nonce when available.
- Netskope recommends blocking the full BSC testnet RPC pool and monitoring non-web traffic for the WebRTC channel; site owners should integrity-check CMS assets.
Article Details
- Attack Vectors
- Injected inline scripts or spoofed packages on compromised websites make JSON-RPC calls to BNB Smart Chain testnet smart contracts and execute returned JavaScript payloads in visitors’ browsers.
- A ClickFix lure directs visitors to paste and run a downloader command from the clipboard; the command pulls and runs a final payload.
- A WebRTC data-channel stager forges its session-description answer, opens a covert channel over UDP, and executes code received through the channel.
- Defensive Notes
- Block the full BSC-testnet RPC pool rather than only the primary endpoint.
- Monitor non-web traffic for the WebRTC channel, which HTTP inspection does not see.
- Site owners should integrity-check CMS assets because the loader may be appended to a legitimate JavaScript file or placed in a fake plugin directory.
MITRE ATT&CK
T1059.001 · PowerShellThe ClickFix lure instructs visitors to paste and run a PowerShell downloader command.T1059.007 · JavaScriptThe injected loader and WebRTC stager execute JavaScript in visitors’ browsers.T1105 · Ingress Tool TransferThe downloader pulls the final payload, and the WebRTC stager receives code over its data channel.T1189 · Drive-by CompromiseThe campaign delivers and executes scripts to visitors through compromised websites.
Products
BNB Smart ChainNetskope telemetry flagged thousands of small-business websites making the same unusual request, a JSON-RPC call to a BNB Smart Chain (BSC) testnet endpoint.PrestaShopWhere we examined individual sites, they were most often WordPress, and sometimes PrestaShop.WordPressWhere we examined individual sites, they were most often WordPress, and sometimes PrestaShop.