Cybercriminals Exploit Thousands of Small‑Business Sites to Distribute Blockchain‑Hosted Malware

A coordinated cybercrime campaign is using more than 5,400 compromised websites to serve a malicious payload known as ClickFix, which is stored in smart contracts on the Binance Smart Chain network. Security analysts say the operation leverages the persistent nature of blockchain data to evade traditional detection methods.

The compromised sites are largely small‑business pages that host basic HTML or e‑commerce functions. Attackers inject a short script that fetches the ClickFix code from a smart contract on the BNB Smart Chain, then delivers it to visitors' browsers. Because the malicious code resides off‑site in a decentralized ledger, removing the script from the web server does not stop the payload from being re‑downloaded.

Researchers who first uncovered the scheme, reported by BleepingComputer, note that the use of blockchain as a storage vector is a growing trend among threat actors seeking resilience. Smart contracts cannot be taken down by a single authority, and the transaction history provides a tamper‑proof record that complicates takedown efforts. In this case, the ClickFix payload is obfuscated within the contract’s bytecode, making static analysis more difficult.

Victims of the campaign include owners of local retail sites, independent service providers, and niche blogs. Users who visit the infected pages may experience drive‑by downloads that install ad‑ware, cryptominers, or credential‑stealing tools. Because the initial infection vector appears innocuous—a legitimate‑looking website—many users are unaware of the risk until suspicious activity is observed on their devices.

Cybersecurity firms recommend a multi‑layered response. Site owners should scan for unauthorized scripts, update content management systems, and employ web‑application firewalls that can block outbound requests to known blockchain endpoints. End users are urged to keep browsers and security software current, and to avoid downloading files from unfamiliar sites.

Law‑enforcement agencies are monitoring the activity, but the decentralized nature of the BNB Smart Chain presents jurisdictional challenges. Analysts predict that attackers will continue to explore blockchain platforms for similar purposes, prompting a push for new detection tools that can correlate on‑chain activity with web‑based threats. In the meantime, heightened awareness and rapid remediation remain the most effective defenses against this emerging attack vector.