5,400 Hacked Sites Deliver ClickFix Payloads via Blockchain Smart Contracts

Sun, 06 Sep 2026 14:08:28 +0000

Engineer — Plan: If you manage any public-facing web properties, audit them for injected ClickFix loader scripts; the blockchain storage makes payload URLs resilient to takedown, so perimeter blocklists alone won’t suffice.
SOC/IR — Act: Active campaign at scale — tune detections for ClickFix behavior patterns: browser-spawned mshta or PowerShell, clipboard-manipulation sequences, and outbound calls to BNB Chain RPC endpoints from endpoints since this campaign began.
Leader — Learn: The use of blockchain smart contracts as an abuse-resistant payload store is a meaningful evasion evolution worth noting; no immediate leadership action needed unless an internal investigation reveals your web presence among the 5,400 compromised sites.

Malware-Campaign on CuraSec