What is ClickFix?

ClickFix (also called FakeCaptcha or ClearFake) is a social engineering technique that tricks website visitors into executing malicious code on their own machine. The attacker compromises a legitimate website and injects JavaScript that displays a fake CAPTCHA, browser update prompt, or error page. The visitor is instructed to:

1. Open the Windows Run dialog (Win+R) or macOS Terminal
2. Paste a command that was secretly copied to their clipboard
3. Press Enter to "verify they are human" or "fix a browser error"

The pasted command downloads and executes the actual malware payload. Because the victim runs the command themselves, traditional security tools that monitor for suspicious process creation or download patterns can be bypassed — the execution originates from a trusted process (PowerShell, Terminal, or Run dialog) initiated by a legitimate user action.

The EtherHiding Technique

EtherHiding is a technique discovered by Malwarebytes researcher Jérôme Segura in 2024, in which threat actors store malicious JavaScript code or configuration data inside blockchain smart contracts. Instead of hosting the second-stage payload on a traditional web server — which can be taken down by hosting providers, registrars, or law enforcement — attackers write the payload into a smart contract deployed on a public blockchain.

The compromised website's injected JavaScript calls the blockchain's RPC endpoint to read the contract's storage, extracts the payload, and executes it in the victim's browser. This approach provides several advantages to attackers:

• Immutable infrastructure: Once deployed, the smart contract cannot be removed from the blockchain. Even if all 5,400+ compromised websites are cleaned, the smart contract payloads remain accessible.
• Dynamic payloads: The attacker can update the smart contract's storage at any time, swapping payloads without modifying the injected script on the compromised websites.
• Free RPC endpoints: The BSC Testnet, designed for developers, is available free of charge — zero operational cost for the attackers.
• Evasion: Blockchain RPC traffic looks different from traditional HTTP C2 calls, making detection harder for network security tools.

Campaign Timeline

The ClickFix blockchain campaign has evolved significantly over the past months. Here is the timeline of key milestones:

Technical Breakdown: The Infection Chain

Here is a step-by-step breakdown of the infection chain as observed by Netskope and corroborated across multiple security vendors:

The WebRTC Variant

Later in the campaign, Netskope observed that the threat actor replaced the ClickFix payload in the smart contract with a WebRTC data-channel stager. This represents a significant evolution in sophistication:

The WebRTC stager works as follows:

1. Peer connection created: The injected JavaScript creates an RTCPeerConnection and a data channel, then generates a session description offer — just like a legitimate WebRTC handshake.
2. Synthetic answer: Instead of sending the offer to a signaling server and waiting for a reply, the script hand-writes the answer itself and feeds it back into the connection. No real handshake occurs, but a data channel to the attacker's C2 is opened.
3. Code delivery: The attacker's C2 server sends JavaScript code through the data channel, which is buffered in the browser.
4. Execution: After the channel closes or 10 seconds elapse, the received code is assembled in the browser's memory and executed dynamically by adding it to the DOM head — never saved to disk.

This technique is particularly dangerous because:

• No file written to disk — traditional file-scanning AV cannot detect it
• WebRTC traffic over UDP looks like normal video/chat traffic to network monitors
• No traditional C2 HTTP beaconing — the data channel is ephemeral

Payload Families Delivered

This campaign infrastructure has been observed delivering a wide range of payloads. ClickFix is primarily a loader-as-a-service ecosystem, meaning different threat actors rent or license the delivery infrastructure for their own payloads. The following payload families have been documented across the ClickFix blockchain campaigns:

Indicators of Compromise (IOCs)

The following IOCs have been collected from public research by Netskope, BleepingComputer, Dark Reading, SOCRadar, THN, Microsoft, Trend Micro, and other sources covering this campaign cluster. All IPs and domains are defanged with [.] notation.

Detection & Mitigation

For Network Defenders

• Block BSC Testnet RPC endpoints — Netskope recommends blocking the entire pool of BSC Testnet RPC endpoints. This breaks the EtherHiding delivery chain.
• Monitor for non-web UDP traffic associated with WebRTC — especially on networks where WebRTC is not expected (corporate internal networks, legacy apps).
• Deploy content filtering to detect Base64-encoded JS blobs in HTTP responses from known websites (unusually large inline script blocks on pages that normally have none).
• Block known malicious domains from the IOC list above at the proxy or DNS level.

For Endpoint Defenders

• Monitor clipboard access events from browser processes — unusual clipboard writes triggered by JavaScript should be flagged.
• Restrict PowerShell execution via AppLocker or WDAC for non-admin users.
• Enable AMSI for PowerShell and VBScript to detect the clipboard-paste attack pattern.
• Deploy EDR with behavioral detection for defender-tampering (Windows Update/Defender disable attempts, as seen in REVSTEALER).

For Website Operators

• Audit WordPress/PrestaShop installations — these platforms represent the overwhelming majority of compromised sites. Update all plugins, themes, and core software.
• Search for injected Base64 blobs in your HTML — look for unusually large inline <script> blocks or hidden iframes.
• Review file integrity — unexpected changes to theme files (header.php, footer.php, index.php) are a common compromise vector.

For End Users

• Never paste commands into Run or Terminal from a website, CAPTCHA, chat message, or popup — no legitimate service requires this.
• Check the URL — ClickFix often triggers on legitimate compromised small-business sites that you trust. Trust the behavior, not the site.
• Manually type known URLs if you see an unusual CAPTCHA on a site you visit regularly.

Conclusion

The ClickFix blockchain campaign represents a fundamental shift in how malware delivery infrastructure operates. By combining social engineering (fake CAPTCHA) with decentralized infrastructure (smart contracts) and stealth delivery (WebRTC data channels), the threat actors behind this operation have created one of the most resilient malware distribution networks ever observed.

With 5,400+ compromised websites, 300+ active per day, and a growing arsenal of payload families ranging from simple infostealers to sophisticated RATs and cryptominers, this campaign will likely continue to expand. The shift to WebRTC stagers suggests that the operators are investing in evasion — and the next iteration may be even harder to detect.

Organizations should implement the mitigations outlined above, monitor Netskope and other security vendors for updated IOCs, and most importantly — train users to recognize and refuse the "paste this command" social engineering technique that is the foundation of every ClickFix attack.