Briefing
A sophisticated, multi-stage attack dubbed ‘ClickFix’ is actively targeting Web3 users by compromising legitimate websites with malicious JavaScript injections. The primary consequence is the theft of user credentials and private keys via common stealers like AMOS and Vidar, leading directly to wallet draining. This campaign achieves high stealth and resilience by using the “EtherHiding” technique, which stores the final-stage malware payload across four separate smart contracts deployed on the Binance Smart Chain.
Context
The prevailing threat landscape has seen a critical increase in supply chain attacks, where threat actors compromise a trusted third-party service to inject malicious code into front-end interfaces. This exploit leverages the inherent trust users place in legitimate websites and exploits the lack of comprehensive security measures that scan for malicious data hidden in on-chain state. The architecture bypasses conventional network-level security tools that typically block known malware delivery domains.
Analysis
The attack chain initiates when a user visits a compromised website, triggering a malicious JavaScript inject that displays a fake CAPTCHA check, the ‘ClickFix’ lure. This script then executes the “EtherHiding” vector, querying a set of four smart contracts on the Binance Smart Chain to retrieve a Base64-encoded payload. A critical “gate contract” controls the delivery, allowing the threat actor to selectively enable or disable the attack by altering on-chain state.
This mechanism ultimately serves an OS-specific stealer that harvests credentials and private keys. The use of the immutable blockchain as a command-and-control server makes the payload highly resistant to takedown attempts.
Parameters
- Attack Vector Obfuscation → Four smart contracts on BSC used for payload storage and delivery.
- Infection Method → Malicious JavaScript injection on compromised legitimate websites.
- Payload Stealers → AMOS and Vidar malware families.
- Control Mechanism → On-chain state change via a “gate contract” to toggle the attack.
Outlook
Immediate mitigation requires all Web3 users to exercise extreme caution with any unexpected CAPTCHA or wallet-signing request, regardless of the host website’s apparent legitimacy. For protocols, this incident establishes a new security standard mandating continuous monitoring for third-party script integrity and the integration of on-chain forensic tools to identify malicious data storage patterns. The technique of using blockchain state for C2 infrastructure is a contagion risk that will likely be adopted by other sophisticated threat actors, necessitating a shift in defense from network-level to on-chain data analysis.
Verdict
This EtherHiding campaign represents a significant escalation in Web3 attack sophistication, demonstrating that threat actors are successfully leveraging the blockchain’s immutability as an undetectable command-and-control infrastructure.
