Threat Actor Tactics and Infrastructure

Initial Compromise

The initial compromise method remains unknown, but each site was injected with a script that gets the next-stage payload from a smart contract on the BSC Testnet endpoint. The BSC Testnet is designed for developers and functions similarly to the mainnet, but is available free of charge.

Delivery Mechanism

The script displays a fake CAPTCHA and instructs visitors to open the Windows Run dialog and paste a PowerShell command. Loading the ClickFix lure downloads and executes the final payload on the machine. The payload is stored in a smart contract, allowing attackers to modify it at any time.

Stager Variant

Later in the campaign, the threat actor replaced the ClickFix payload with a WebRTC data-channel stager. The stager establishes a covert encrypted channel to the attacker and executes the received code.

WebRTC Stager

The stager receives JavaScript code from the hardcoded command-and-control (C2) address, buffers it, and executes it when the channel closes or after ten seconds. The received code is assembled in the browser memory and executed dynamically without being saved to disk by adding it to the head of the DOM.

Security Measures

The security researchers recommend that defenders block the entire pool of BSC testnet RPC endpoints provided here and monitor for non-web UDP traffic associated with WebRTC.

Threat Actor Tactics and Infrastructure

Daily Operations

The operation uses more than 300 infected websites every day. Since spring, the number of compromised sites contacting the BSC Testnet RPC endpoints has grown constantly. Telemetry data shows that nearly 400 websites called the endpoint every day in August, with an all-time peak of 536.

Prevention Scores

Once attackers have valid credentials, only 37% of their actions are blocked. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Threat Actor Tactics and Infrastructure

Prevention and Detection

The security researchers recommend that defenders block the entire pool of BSC testnet RPC endpoints provided here and monitor for non-web UDP traffic associated with WebRTC. Once attackers have valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.