Campaign Overview

A sophisticated campaign has been discovered where over 5,400 compromised websites are actively serving malicious payloads. These sites, primarily running on WordPress and PrestaShop platforms, are being used to distribute a malware known as ClickFix. The attack vector is particularly noteworthy as the malware's configuration and instructions are stored on the blockchain, specifically using Ethereum and BNB Smart Chain. This method of obfuscation makes it significantly harder for security researchers to track and disrupt the campaign.

The campaign, first detailed by BleepingComputer and further analyzed by Netskope Threat Labs, highlights a growing trend of attackers utilizing decentralized storage and execution methods to evade detection. The compromised websites act as intermediaries, redirecting unsuspecting users to malicious infrastructure where the ClickFix malware is ultimately delivered. The reliance on blockchain technology for storing critical campaign data represents a novel approach to malware distribution, blending traditional web compromises with decentralized ledger technology.

Diagram illustrating the ClickFix malware distribution chain from hacked site to blockchain

ClickFix Malware and Its Functionality

ClickFix is a form of information-stealing malware designed to compromise user sessions and inject malicious content into web pages. Its primary objective appears to be hijacking user interactions, potentially for click fraud, ad injection, or credential theft. The malware operates by injecting JavaScript into the compromised websites, which then executes on the visitor's browser.

When a user visits a hacked site, the injected JavaScript fetches instructions from the blockchain. These instructions dictate how the malware should behave, including what malicious content to serve or what actions to perform. This dynamic approach allows the attackers to update the malware's behavior without needing to re-compromise the websites, making the campaign more resilient and adaptable. The specific payloads can vary, but common functionalities include injecting advertisements, redirecting users to phishing sites, or attempting to steal session cookies.

Blockchain as an Obfuscation Layer

The use of blockchain technology by attackers is a significant escalation in the cat-and-mouse game between cybercriminals and security professionals. Storing malware configuration data on public blockchains like Ethereum and BNB Smart Chain offers several advantages for the attackers:

  • Immutability and Persistence: Once data is written to the blockchain, it is extremely difficult to alter or remove. This ensures the malware's instructions remain available and consistent.
  • Decentralization: Unlike traditional command-and-control (C2) servers, which can be taken down by law enforcement or security researchers, blockchain nodes are distributed globally, making them highly resistant to takedowns.
  • Obfuscation: The data on the blockchain is often encoded or encrypted, making it unintelligible to casual observers. Only the malware itself, with the correct decoding mechanism, can interpret these instructions.
  • Cost-Effectiveness: While transactions on some blockchains incur fees, the overall cost for attackers to host their C2 infrastructure in this manner can be relatively low compared to maintaining dedicated servers.

This innovative technique allows the malware to appear less suspicious to traditional security tools that might monitor network traffic for connections to known malicious IP addresses or domains. The blockchain acts as a de facto distributed, censorship-resistant C2 server.

Targeted Platforms and Vulnerabilities

The attackers are specifically targeting websites built on popular content management systems (CMS) like WordPress and e-commerce platforms such as PrestaShop. These platforms are widely used globally, providing a large attack surface. The exact vulnerabilities exploited to gain initial access to these sites are not always disclosed, but common methods include:

  • Outdated Software: Exploiting known vulnerabilities in outdated versions of WordPress, PrestaShop, their themes, or plugins.
  • Weak Credentials: Brute-forcing or guessing weak administrator passwords for the CMS backend.
  • Compromised Hosting Accounts: Gaining access to the underlying web hosting environment through other means, such as shared hosting compromises or phishing attacks against hosting providers.

Once access is gained, attackers typically upload malicious files, modify existing ones to include backdoors or malicious redirects, and establish persistence. The goal is to turn the legitimate website into a distribution point for their malware without the site owner's knowledge.

WebRTC and ClickFix Interaction

The mention of WebRTC (Web Real-Time Communication) paths in relation to this campaign suggests a potential technique for enhanced malware delivery or communication. WebRTC is a technology that enables real-time voice, video, and data communication directly between browsers and devices. Attackers might be leveraging WebRTC for several purposes:

  • Peer-to-Peer Communication: Potentially establishing direct, encrypted communication channels between infected clients or between clients and attacker-controlled nodes, bypassing traditional network monitoring.
  • Data Exfiltration: Using WebRTC data channels to exfiltrate stolen information from infected systems.
  • Payload Delivery: While less common, WebRTC could theoretically be used to facilitate the delivery of certain types of payloads or updates.

The integration of WebRTC adds another layer of complexity to the attack, potentially making detection and analysis more challenging. It blurs the lines between user-generated real-time communication and malicious network activity.

Mitigation and Prevention

Website owners and administrators must take immediate steps to secure their platforms against this type of attack:

  • Regular Updates: Keep WordPress, PrestaShop, themes, plugins, and server software up-to-date with the latest security patches.
  • Strong Passwords and Authentication: Use strong, unique passwords for all administrative accounts and hosting access. Implement two-factor authentication (2FA) wherever possible.
  • Security Plugins/Extensions: Install and configure reputable security plugins or extensions that can scan for malware, monitor file integrity, and block malicious access attempts.
  • Web Application Firewalls (WAF): Deploy a WAF to filter malicious traffic and block common web attacks.
  • Regular Backups: Maintain regular, off-site backups of website files and databases to facilitate recovery in case of a compromise.
  • Monitor Website Integrity: Regularly check website files for unexpected modifications and monitor server logs for suspicious activity.

For end-users, vigilance is key. Be cautious of unexpected redirects, pop-ups, or requests for information on websites, even those that appear legitimate. Ensure your browser and security software are up-to-date.

Broader Implications

This campaign demonstrates a significant evolution in malware distribution tactics. The combination of website compromises, blockchain-based C2, and potentially WebRTC integration creates a highly resilient and evasive threat. It signals that attackers are actively exploring and integrating new technologies to enhance their operations and evade security measures. The continued use of blockchain for malicious purposes poses a new challenge for cybersecurity professionals, requiring advancements in tools and techniques capable of analyzing on-chain data and correlating it with off-chain activities.