Security1 publisher2 min readPublished
ClickFix crews are staging the second stage inside Binance Smart Chain smart contracts
Blackpoint's SOC worked an incident where a fake captcha on the victim company's own WordPress site ran a hidden PowerShell downloader, and the campaign's later stage sits in a blockchain contract no provider can pull.
The Watch · Security desk
What happened
- Blackpoint's SOC worked an incident in which two users at one company were talked into pasting a fake captcha's PowerShell command into the Windows Run dialog, with Defender for Endpoint flagging the behavior from explorer.exe.
- The company's own WordPress site was serving the fake captcha, compromised by the same ClickFix campaign and carrying injected JavaScript obfuscated with the free Obfuscator.io service.
- Once the code is written to the contract it cannot be removed, and Blackpoint says one update to the contract changes the payload for the whole campaign at once.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint An abuse report closes the two parts of this chain the operator can replace cheapest, so takedown effort goes into the disposable half while the payload store stays live.
- exposure When the lure is hosted on a company's own WordPress install, staff meet it on a domain their instincts and their allowlists already trust.
- capability Payload-based indicator sharing now has a shelf life the operator sets: one transaction re-points every compromised site at new code.
The fake captcha and its loader JavaScript sat on a compromised WordPress site, the one belonging to the victim company [13]. Blackpoint traced the first stage to a separate domain, fetched as a GUID-named file with a .t extension [9]. The second stage sits in a Binance Smart Chain contract [2]. A hosting provider can clean the first and a registrar or host can pull the second, but the code in the contract cannot be pulled [3]. Two of the three hosting points in the observed chain can be removed by somebody with an abuse desk [17].
The update path is where the cost sits. Rotating a staging domain costs the operator a registration and a redeploy. Changing the payload every defender is watching costs one write to the contract, and Blackpoint says that single push updates the entire campaign at once [5].
The command opened PowerShell in a hidden window with -w h, pulled the remote file with Invoke-RestMethod through the irm -useb shortcut, then piped the response into a second PowerShell instance that ran whatever came back [10]. That is where the alert fired. A second host on the same network fired the same alert within ten minutes of the first [11]. Blackpoint wrote that this "indicates that these users are either receiving the link to this compromised site via email or are visiting a well-known site which led to their compromise" [12].
The injected JavaScript was obfuscated with the free service Obfuscator.io, and Blackpoint says the result reverses with obf-io.deobfuscate.io [15]. The WordPress side is the tractable half. The page also pulled a reCAPTCHA from gstatic, Google's static content host, so the lure sits on a domain most egress policy allows [14]. Blackpoint published the PowerShell command with the staging domain replaced by a placeholder and did not give a contract address, so a team that wants to alert on the chain-side fetch has to extract the endpoint from its own copy of the loader [16].
The write-up covers one incident on one customer network [6]. The wider claim is about caseload: "The Blackpoint SOC continues to see the utilization of Blockchain, more specifically smart contracts on the Binance Smart Chain (BSC), within ClickFix campaigns," the company wrote [1].
What to watch
- Whether Blackpoint or others publish the contract addresses and RPC endpoints for the BSC stage, which is what makes network-side alerting possible outside the firms holding loader samples.