Covert command and control

A loader on 5,400 hacked sites borrows the page's own CSP nonce to execute

Compromised WordPress and PrestaShop pages fetch their next stage with a JSON-RPC eth_call to BNB Smart Chain Testnet, so the artefact sitting on the site is a request, not a file you can quarantine.