EtherHiding puts the payload where takedown does not reach. A smart contract on a public chain has no host to serve an abuse notice on and no registrar to suspend, and Netskope describes that resilience as the point of the technique [3]. What the contract does have is a read path. Each of the injected scripts has to call a BSC Testnet RPC endpoint to get its next stage [2], and that is the control Netskope actually puts first: block the entire pool of testnet RPC endpoints, then watch for non-web UDP traffic associated with WebRTC [13]. Deleting the contract and cutting the fetch are different problems, and only one of them is available.
Netskope notes the BSC Testnet behaves like the production chain but is free to use [4], so rewriting the payload for every one of the 5,400 sites at once costs the operator nothing and needs no funded wallet [6]. The operator has already used that: later in the campaign the ClickFix payload in the contract was swapped for a WebRTC data-channel stager [7].
It creates a peer connection and a data channel and generates a session description offer as a normal handshake would, then, in Netskope's words, "hand-writes the answer itself and feeds it straight back into the connection," so no handshake with a remote peer occurs but a data channel to the attacker opens anyway [8]. It pulls JavaScript from a hardcoded C2, buffers it, and runs it when the channel closes or after ten seconds [9]. The code is assembled in browser memory and appended to the head of the DOM, never written to disk [10].
Netskope identified more than 5,400 compromised sites, says the operation uses over 300 daily, and measured close to 400 daily callers to the testnet RPC endpoints in August with an all-time peak of 536 [1][11][12]. That peak is 9.9 percent of the identified pool; the August average is 7.4 percent [15][16]. Roughly nine in ten known sites are idle on any given day, so scrubbing the hosts that appeared in yesterday's telemetry leaves the inventory intact.
One step in the first chain requires the victim: the fake CAPTCHA tells the visitor to open the Windows Run dialog and paste a PowerShell command, and the final payload does not download until they do [5]. That step is absent from Netskope's account of the newer variant, which executes received code in browser memory [17]. Blocking the paste covers the ClickFix delivery and not the stager that replaced it, which leaves two network controls carrying the campaign: the testnet RPC pool, and UDP egress from browsers that has no business existing on most corporate networks [13].
