Netskope details EtherHiding campaign using BNB Smart Chain testnet and a WebRTC variant

EtherHiding activity has been observed across more than 5,400 compromised small-business websites, using BNB Smart Chain testnet smart contracts to retrieve payloads. The update matters for security teams because it combines blockchain-based payload hosting with browser delivery mechanisms, including a newly identified WebRTC data-channel variant.

Research Overview

Netskope reports that it detected a large cluster of small-business websites making the same unusual telemetry pattern: JSON-RPC requests to a BNB Smart Chain testnet endpoint. The sites span multiple types, including WordPress and, in some cases, PrestaShop.

The vendor notes that the initial compromise method is not known in its observations. It also describes each site as having a small injected loader that reads a next-stage payload from a smart contract and executes it in the visitor’s browser when the page loads.

Key Findings

Across the observation period, the report counts more than 5,400 distinct compromised websites beaconing those testnet RPC endpoints. The activity spans more than 2,200 organizations worldwide, with several hundred active on any given day.

Netskope states that the daily volume trended upward from spring and that it is seeing more than 300 sites each weekday. The blog also mentions that the compromised sites had little in common beyond being small businesses.

Technical Breakdown

The delivery approach centers on blockchain smart contracts as a “dead drop,” where the operator can update what compromised sites deliver by changing a single contract. Visitors retrieve the latest version on the next page load via the injected loader’s JSON-RPC eth_call.

In the described chain, the loader may be an inline script or a spoofed package, and it pulls a second-stage script from the testnet contract for execution. One observed path leads to a ClickFix lure that blurs the page behind a fake CAPTCHA overlay, then asks the visitor to open a Run dialog and paste a command.

Product Update

Netskope’s blog characterizes the testnet choice as a way to avoid monetary costs while retaining the same smart-contract hosting and takedown-resistant behavior associated with mainnet. It describes testnet as a parallel chain where BNB has no monetary value and is distributed by faucets for free.

According to the report, this allows operators to deploy and update contracts without spending anything, repurposing free developer infrastructure for durable payload delivery.

Threat Analysis

The blog also describes a newer variant that replaces the ClickFix step with a WebRTC data-channel stager. In this variant, the JSON-RPC eth_call supplies JavaScript whose purpose is to open a covert data channel and run code received through it.

Netskope explains that typical WebRTC uses a signaling process and produces observable artifacts such as DNS lookups, STUN/TURN traffic, and DTLS handshake packets. In the sample described, the script forges the answer locally by hardcoding values such as the C2 IP components, UDP port, ICE password, and DTLS fingerprint, then it establishes the encrypted channel without signaling traffic.

Operational Impact

The report states that after the channel opens, the C2 streams code over the data channel, and the browser executes the reassembled result when the channel closes or after a ten-second backstop. It also notes that the staged execution does not write to disk.

For execution behavior, Netskope describes that the code is executed by appending it to the head of the DOM, and that to match the site’s Content Security Policy, the stager lifts a nonce from a legitimate script already present on the page and reuses it on its own injected script.

This blog signals brief reflects a Netskope report of EtherHiding campaigns using BNB Smart Chain testnet smart contracts across thousands of compromised sites, including a WebRTC data-channel variant that bypasses typical signaling artifacts. It is a fact-based summary of the vendor blog for enterprise decision-makers focused on detection, monitoring, and incident response.

Blog post, originally published by John Carlo Marquez at netskope.com.