Attackers have quietly broken into more than 5,400 small-business websites and turned them into traps. Visitors to those sites are shown fake pop-up messages warning that something is wrong with their browser or internet connection. The message asks them to paste a command into their own computer to fix the problem. There is no problem. The command is the attack. Security researchers have identified this as a ClickFix campaign — and what makes this one different from others is where the harmful instructions are stored.
What happened
The attackers did not just hack the websites and leave. They altered each site to display a convincing-looking system notice. That notice uses a technique called ClickFix: it creates a fake sense of a technical fault and tells you the fix is simple — just open a window on your computer and paste in the text provided.
In most attacks like this, the harmful instructions are stored on a server the attackers control. Security teams have become good at finding those servers and shutting them down. This time, the attackers stored their payloads inside smart contracts on a blockchain. A smart contract is a small piece of code that lives permanently on a public blockchain network. It cannot be easily deleted or taken offline by anyone — including the people who wrote it.
That is the significant detail. Even if every one of the 5,400-plus hacked websites is cleaned up today, the malicious instructions sitting on the blockchain remain there, ready to be called upon again.
Who is affected
The compromised sites belong to small businesses — local shops, tradespeople, independent service providers. These are not obscure corners of the internet. They are the kinds of sites ordinary people visit without any reason to feel cautious.
The attack does not aim at a particular type of person. It catches whoever happens to land on one of those pages and follows the on-screen instruction without stopping to question it. People who are less familiar with how browsers behave are at higher risk. A routine-looking system notice is easy to believe if you have never seen a fake one before.
The potential audience is wide precisely because the entry point is so unremarkable. You searched for a local plumber or a nearby café. That is all it takes.
What the real risk is
If you follow the pop-up instruction and paste the command into your computer, you are carrying out the attackers’ action yourself. The exact payload — meaning what the command actually does to your machine — has not been fully disclosed in public reporting. What is known is that ClickFix malware attacks of this type are typically used to install software that steals passwords, banking credentials, or other personal data.
The blockchain delivery method creates a specific problem for security tools. Software that blocks known malicious web addresses works by recognising harmful locations. A blockchain address used to store a payload does not look like a traditional malware server, so existing filters may not catch it.
There is also a trust gap. You arrived at a legitimate business website. Your guard is lower than it would be on a page that already looked suspicious. The attackers are counting on exactly that.
What to do today
These steps are specific and you can take them now.
- Never paste anything into your computer based on a website message. No real browser error, no genuine connection problem, is ever fixed by opening a command window and pasting text into it. If a website tells you to do this, it is an attack. Full stop.
- If you see one of these pop-ups, close the entire browser tab immediately. Do not click anything inside the pop-up — not even a button that says close or dismiss. Some versions of this attack are designed to trigger on any click at all.
- Update your browser and operating system this week. Go into your device settings, find the update section, and run any pending updates. Attackers use known security gaps to make their fake messages look more convincing. Updates close those gaps.
- If you think you already followed one of these instructions, disconnect from your internet connection straight away. Then run a scan using a reputable security tool — well-known options include Malwarebytes and your operating system’s built-in scanner. After that, change the passwords for your email, banking, and any other important accounts, but do this from a different device you trust to be clean.
- Tell the people around you. Explain to family members — particularly anyone who might not question an on-screen instruction — that no website will ever need them to paste a command into their computer. One sentence of warning now could prevent a serious problem later.
Why this keeps happening
Small-business websites are an attractive target because their owners often have limited time and money for security. A compromised site may go unnoticed for months, giving attackers a stable, trusted-looking platform.
Storing the payload on a blockchain is a direct adaptation to the fact that defenders have gotten faster at removing harmful servers. When one method of delivery gets blocked, attackers move to one that is harder to remove. A blockchain entry fits that requirement almost perfectly.
The ClickFix technique itself works because it reverses the usual dynamic. Instead of silently installing something, it convinces you to perform the action yourself. From your computer’s point of view, you gave the instruction. That makes it harder for security software to flag as an intrusion.
Fake urgency is what makes the whole thing run. The message implies something is broken right now and must be fixed immediately. That pressure is engineered to stop you pausing long enough to ask whether the message is genuine.
Underneath all of this is a structural problem. Online systems currently have no reliable way to confirm that the person or organisation behind a website, a smart contract, or a pop-up message is who they claim to be. Because there is no dependable link between an online action and a real, accountable identity, the response to schemes like this is always reactive — chase the attackers after the damage is done, clean up the hacked sites, try to trace the blockchain addresses. The foundation that would allow harmful actors to be identified and stopped before they act is simply not in place. Until it is, campaigns built on ClickFix malware and hacked websites will keep finding new technical shelters.
Frequently asked questions
How do I know if a website I visited was one of the hacked ones?
There is no simple public list you can check. The clearest sign is whether you were shown a pop-up asking you to copy and paste a command. If you saw that message and did not follow the instruction, you were likely not harmed. If you did follow it, treat your device as potentially compromised and follow the steps in the section above.
Can my antivirus software protect me from this kind of attack?
Possibly, but not reliably in this case. Because the malicious instructions are stored on a blockchain rather than a known harmful server, traditional security tools that work from lists of bad addresses may not recognise the threat. Keeping your security software updated gives you the best chance, but it is not a guarantee. The most effective protection is simply not following the pop-up instruction in the first place.
Why would a small local business website be dangerous?
The danger does not come from the business itself. The site has been altered without the owner’s knowledge. Attackers target small-business sites because they tend to have fewer security measures and may go unchecked for long periods. The business is a victim too. The site just happens to be the delivery point.
Related reading
- IDScan Data Breach: What to Do If Your License Was Exposed
- Hospital Health Data Breach: What Patients Should Do Now
Originally reported by bleepingcomputer.com. This article summarises that reporting and adds practical guidance.
Mafiology tracks the tactics behind these schemes so you can recognise them early. Get our fraud-pattern alerts, plus a free copy of Wes Kussmaul’s Escape the Plantation on how scammers attack you and your family, and what can be done to stop them.
