Over 5,400 Compromised Websites Deliver ClickFix Payloads via BNB Smart Chain Smart Contracts

A cybersecurity report published by BleepingComputer details a significant campaign in which over 5,400 hacked small-business websites are serving ClickFix payloads stored on the BNB Smart Chain (BSC). According to the report, cybercriminals have compromised a large number of small-business websites and are using them as delivery vectors to redirect visitors to smart contracts deployed on the BNB Smart Chain. These contracts host the malicious ClickFix payloads, which visitors encounter when accessing the compromised sites.

The exact ClickFix payload behavior and infection chain are still under investigation, but the mechanism relies on the compromised websites redirecting traffic to the blockchain-based contracts. The use of smart contracts on a public blockchain allows the threat actors to host and update malicious content while potentially evading traditional takedown efforts targeting individual web domains.

The report notes that the compromised sites are predominantly small-business domains, suggesting that the actors are exploiting vulnerabilities or weak security configurations common in this sector. Visitors to these sites may be exposed to credential theft, financial fraud, or additional malware infection, depending on the specific payload delivered through the smart contract.

Security experts recommend that website owners audit and secure their environments, apply available patches, and monitor for unauthorized changes. Users are advised to exercise caution when visiting small-business websites and to ensure browser and security software are up to date. As of the reporting date, no specific software patch addressing the ClickFix payload itself has been identified, as the threat leverages the blockchain infrastructure and compromised web properties.