Microsoft researchers detected a new campaign that converts compromised WordPress sites into a blockchain‑backed command infrastructure.

How the attacks operate

Attackers embed a concealed script on a breached site, disguising it as part of the theme or a legitimate plugin to avoid detection.

• The script queries a smart contract on BNB Smart Chain, and in some operations it uses Polygon, to obtain an active payload address.
• Visitors are presented with a fake captcha prompt that requests keystrokes: Win+R → Ctrl+V → Enter; the attacker's command is copied to the clipboard beforehand.
• Following the keystrokes, the site triggers system utilities such as PowerShell, MSHTA or rundll32 to retrieve and run the main payload.
• The downloaded components are typically infostealers or RATs that aim to exfiltrate data or provide persistent remote control.

Why this approach is dangerous

By storing operational parameters in a smart contract, attackers can alter their infrastructure without re‑compromising the hosting sites, increasing resilience.

Defenses based on blocking known domains or IP addresses become less effective, since the blockchain reference can redirect victims to new endpoints on demand.

Payloads and consequences

Infostealers typically harvest credentials, cookies and local files, while RATs grant broad remote access to the infected machine for further actions.

This combination enables theft of sensitive information and long‑term persistence, complicating incident response and cleanup procedures.

Implications for security teams

The campaign illustrates a shift toward using decentralized infrastructure for command‑and‑control, which complicates attribution and blacklist‑based prevention techniques.

Visibility into atypical use of system utilities and suspicious clipboard manipulation may help identify exploitation attempts before substantial compromise occurs.