EtherHiding Campaign Uses BNB Smart Chain and Covert WebRTC Channels
Summary
Netskope reports more than 5,400 compromised sites using BNB Smart Chain testnet contracts to deliver ClickFix lures or a covert WebRTC command channel; the initial compromise method is unknown.
Key points
- Netskope observed more than 5,400 distinct compromised sites across over 2,200 organizations; several hundred were active on a typical day.
- The sites were mostly WordPress, with some PrestaShop installations. How they were initially compromised remains unknown.
- Injected loaders use JSON-RPC calls to BNB Smart Chain testnet contracts to retrieve scripts; operators can change delivered payloads by updating a single contract.
- One delivery path presents a ClickFix fake CAPTCHA that instructs visitors to run a command, which downloads and executes a payload.
- A newer variant forges a WebRTC session answer locally, opening a covert data channel without normal signaling traffic; code received over the channel is executed in the browser.
- Netskope recommends blocking the full BSC testnet RPC pool, monitoring non-web traffic for the WebRTC channel, and integrity-checking CMS assets.
Article Details
- Attack Vectors
- Injected inline scripts or spoofed packages on compromised websites make JSON-RPC eth_call requests to BNB Smart Chain testnet smart contracts and run the returned script.
- A returned script may display a ClickFix lure that instructs visitors to open a Run dialog and execute a pasted command; the command downloads and runs a final payload.
- A newer variant uses a WebRTC data-channel stager that forges its session-description answer, opens a covert channel over UDP, and executes code received through the channel.
- The initial compromise vector for the websites is unknown.
- Defensive Notes
- Block the full BNB Smart Chain testnet RPC pool rather than only the primary endpoint.
- Monitor non-web traffic for WebRTC data-channel activity that HTTP inspection may not observe.
- Integrity-check CMS assets for injected loaders appended to legitimate JavaScript files or placed in fake plugin directories.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign's injected inline loader is described as obfuscated.T1059 · Command and Scripting InterpreterThe ClickFix lure instructs visitors to open a Run dialog and paste a command that executes attacker-controlled code.T1059.001 · PowerShellA ClickFix command pasted by the visitor is described as a PowerShell downloader that pulls and runs the final payload.T1071.001 · Web ProtocolsThe campaign uses HTTP-delivered scripts, and its WebRTC variant transfers code over a browser-based data channel.T1102 · Web ServiceThe loader retrieves scripts from BNB Smart Chain testnet smart contracts through JSON-RPC eth_call requests.T1105 · Ingress Tool TransferThe command executed through the ClickFix lure downloads the final payload.T1132.001 · Standard EncodingThe WebRTC stager constructs the C2 IP from separate numbers so it does not appear as a contiguous string.
Products
BNB Smart Chainhas been used on more than 5,400 compromised small-business websites to fetch payloads from BNB Smart Chain testnet smart contracts, enabling takedown-resistant delivery of ClickFix lures or a covert WebRTCPrestaShopMost examined sites were WordPress, with some PrestaShop installations also affected; the initial compromise vector remains unknown.WordPressMost examined sites were WordPress, with some PrestaShop installations also affected; the initial compromise vector remains unknown.