EtherHiding: the lure lives on the blockchain.

How the attack works

1. A legitimate site (often WordPress) is compromised and a loader script is added.
2. The loader makes an eth_call to a contract on BNB Smart Chain or Polygon through a public RPC node.
3. The contract returns the current lure host or script. The attacker can change it at any time for cents, without touching the compromised site.
4. The victim sees a fake CAPTCHA or browser-update page — usually a ClickFix lure.

Google’s Threat Intelligence Group counted about 14,000 injected pages in one campaign; CTM360 identified 17,000 compromised URLs in September 2026 and noted that domain blocking is only a limited mitigation.

Why most tools miss it

Web3 security products inspect transactions sent to a wallet. Phishing products look at URLs. An EtherHiding loader does neither: it reads a contract from a page that has nothing to do with crypto.

How ByteMantle detects it

• RPC calls are observed in the page — including public BNB, Polygon and Ethereum nodes.
• Context decides: a page with no wallet activity that reads a contract is suspicious; if the decoded response contains a URL or domain, it is flagged as high severity.
• Correlation: contract read followed by a ClickFix lure or a malicious clipboard write becomes a single critical incident — ClickFix via EtherHiding — mapped to MITRE T1102.001 (Dead Drop Resolver) and T1204.004.
• Detection, not disruption: contract reads are never blocked automatically, so legitimate dApps keep working.

From one page to the whole campaign

• The campaign map groups every site that reads the same smart contract, so a wave of compromised sites becomes one finding.
• The script chain shows which script on the compromised site loaded the code that queried the contract.
• The software behind the site Enterprise: these campaigns live on outdated WordPress sites and plugins; Technology & Exposure shows which sites your people use report them.
• Share it: the incident and its graph export as STIX 2.1, with the contract address, for your threat-intelligence platform.

Read the guideEtherHiding: the malware host nobody can take down