Thousands of small-business websites have been quietly turned into traps. Visitors land on pages that look completely normal and walk away with malware on their devices — without clicking anything suspicious. For freelancers, independent creators, and anyone who runs their own site, this is a direct threat to their work, their clients, and their reputation. Understanding what is happening is the first step toward better creator cybersecurity data protection.
What happened
A large-scale criminal operation has taken over thousands of small-business websites and is using them to push malicious software onto visitors’ devices. The technique is called ClickFix.
Here is how it works. You visit a site. A prompt appears — it might look like a CAPTCHA verification or a browser update message. It tells you to run a quick fix on your own computer. You follow the instruction. That action executes the malware. You did the work yourself, without knowing it.
What makes this operation harder to stop than most is where the harmful instructions are stored: inside smart contracts on the BNB Smart Chain, a blockchain network. A blockchain is a public, distributed ledger — no single company or server hosts it. That design means there is no single host to switch off. Standard takedown requests, which work when criminal code lives on a normal web server, simply do not apply here.
The number of compromised sites runs into the thousands. Which categories of sites were targeted most has not been disclosed.
Who is affected
The business that owns the compromised site is not the only victim. Anyone who visits is a potential target.
Small-business websites are the entry point, which means the people most at risk are ordinary visitors — including freelancers, independent creators, and founders — who land on a page that gives no obvious warning sign.
If you run your own website as part of your personal brand or business, your site could already be one of the compromised ones without your knowledge. That means you could be putting your own visitors at risk right now.
Creators are particularly exposed for a practical reason: many use the same machine for browsing and for storing client files, contracts, unreleased work, and saved login credentials. If malware gains a foothold on that machine, everything on it is potentially reachable.
What the real risk is
The most immediate danger for creators and freelancers is credential theft. Malware delivered this way commonly harvests saved passwords, session tokens, and account cookies — the small files that keep you logged in to sites without re-entering a password.
With those in hand, an attacker can access your portfolio platforms, cloud storage, client communication tools, and anywhere else you have a saved login. Your intellectual property and your client relationships are both at risk.
The possible consequences are concrete:
- An attacker copies unreleased work before you publish it.
- They impersonate you in messages to clients.
- They lock you out of your own accounts and demand payment to restore access.
For anyone running their own site, being silently compromised means you are unknowingly harming the audience you built. That carries reputational consequences and, depending on your country, may have legal implications — though how that plays out varies by jurisdiction and a lawyer would need to advise on your specific situation.
Because the malicious code sits on a blockchain rather than a conventional server, the campaign can keep running long after it is publicly known about. There is no kill switch.
What to do today
These are concrete steps you can take this week. Start with the ones that apply to your situation.
If you own a website
- Log into your hosting control panel now. Look at recently modified files. Most hosts show a file manager with timestamps — anything changed in the last few weeks that you did not change yourself is worth investigating.
- Check your site’s pages and templates for unfamiliar code. Injected scripts often appear as a single long line of scrambled characters near the top or bottom of a page’s source code. If you see something you did not put there, flag it.
- Run a security scan. Many hosting providers offer a built-in malware scanner at low or no cost. If yours does not, free tools like Sucuri SiteCheck let you enter your URL and scan for known infections.
- Enable a web application firewall (WAF). Think of it as a filter that sits in front of your site and blocks known malicious traffic. Several hosting providers include one in their standard plans.
- If you find something, act fast. Notify your hosting provider directly — they have seen this before and can help. Take the site offline temporarily if needed. Then tell your regular visitors or clients what happened so they can check their own devices.
On your own devices
- Stop clicking ‘run this fix’ prompts on websites. No legitimate site needs you to open your computer’s command line or paste a command to verify you are human. That is exactly how ClickFix works. If you see it, close the tab.
- Audit every account that matters to your work. Email, file storage, client portals, social platforms — go through them one by one and turn on two-factor authentication (2FA) on each. Two-factor authentication means that even if someone steals your password, they still need a second code from your phone to get in.
- Change passwords for any account you accessed recently from a device you are not certain is clean. Use a password manager — free options include Bitwarden — so each account gets a unique password you do not have to remember.
- Update your software. Operating system, browser, plugins, themes — run available updates today. Most attacks exploit known weaknesses that updates already fix.
Why this keeps happening
Small-business and creator websites make attractive targets because they tend to run on plugins, themes, or content management systems that go months without being updated or audited. That is not a character flaw — it is a resource problem. Building and shipping takes priority, and security maintenance falls behind.
But there is a deeper structural issue at work here, one that goes beyond outdated plugins.
Criminals are now deliberately building their operations on infrastructure — like public blockchains — that was designed to resist censorship. That design principle, which has legitimate uses, also means the usual remedies do not apply. The playbook that security teams have relied on for years simply does not work against it.
The ClickFix technique exploits something more fundamental: trust. When you intentionally visit a site, you extend it a degree of trust. That trust is the real vulnerability being exploited — not a technical flaw, but a human one.
And at the root of all of this is a problem that creator cybersecurity data protection conversations rarely address directly: online systems have no reliable way to tie ownership or accountability to a real, verifiable person. When a site is compromised, the attacker operates anonymously. When your credentials are stolen, there is no clear chain of custody for your work or your identity. Platforms and data brokers fill that vacuum by claiming default control over accounts and content — because without a trustworthy way to establish who actually owns something, the platform’s claim stands by default. Until that changes, mass compromise of small sites will remain an efficient, low-cost strategy for attackers.
Frequently asked questions
How do I know if my own website has been used to deliver malware to visitors?
Log into your hosting control panel and look for files that were modified recently without your knowledge. Run a free URL scan through your hosting provider’s built-in tool or a third-party scanner like Sucuri SiteCheck. If you find unfamiliar code — especially a dense, scrambled line of characters — treat it as suspicious and contact your host immediately.
If I just visited a compromised site but did not click anything, am I safe?
The ClickFix attack specifically requires you to follow a prompt and run something on your own machine. If you visited a page, saw a suspicious prompt, and closed the tab without clicking or pasting anything, your risk is significantly lower. That said, if you are uncertain, running an up-to-date antivirus scan on your device is a reasonable precaution.
Why is storing malware on a blockchain harder to stop than on a normal server?
A normal server is owned by someone — a hosting company, a business, an individual. Security teams can contact that owner or file a legal request to have malicious content removed. A blockchain is a distributed public ledger with no single owner and no central point of control. There is nobody to send a takedown notice to, and the data cannot be deleted once it is written. That is why the campaign described here can keep running even after it becomes publicly known.
Related reading
- 153 Million Licenses Exposed: What Creators Must Do Now
- ARM Windows Crashes: A Creator’s Data Recovery Plan
Originally reported by bleepingcomputer.com. This article summarises that reporting and adds practical guidance.
Scams, fraud, bots and manufactured noise keep spreading because the internet was built with no reliable way to know who anyone actually is. Everyone deserves authenticity and accountability online, and that is the mission we are working on. Subscribe to stay informed as this story develops and to get practical guidance on protecting your work.
This article is general information, not legal advice. Laws differ by country — consult a qualified lawyer about your situation.
