January 1, EXPOSED: Trusted Websites Turned Into Traps for Unsuspecting Americans

Wyatt’s Take

• Over 5,400 legitimate small business websites have been hijacked by hackers to spread malware that tricks you into infecting your own computer
• The scam uses fake CAPTCHA screens on real websites you trust — telling you to paste dangerous commands into Windows that install malware
• Criminals are using cryptocurrency blockchain networks to hide their attack infrastructure and make it nearly impossible to shut down

You click on the website of your local plumber or family doctor. Everything looks normal. Then a CAPTCHA pops up asking you to verify you’re human.

But this time, it tells you to open Windows Run and paste in a command. That’s when alarm bells should go off.

Security researchers just uncovered a massive criminal operation that’s turned thousands of trusted small business websites into malware distribution points. More than 5,400 legitimate sites across 2,200 organizations worldwide have been compromised in recent months.

These aren’t shady corners of the internet. We’re talking about real businesses — medical clinics, plumbing companies, local shops — that hardworking Americans visit every day.

The criminals are targeting websites that run on WordPress and PrestaShop platforms. Researchers still don’t know exactly how the hackers are breaking into these sites in the first place, which makes the threat even more dangerous.

On any given day, several hundred of these infected sites are actively spreading malware. Security experts have tracked more than 300 compromised websites connecting to criminal infrastructure every single weekday.

Here’s how the trap works. Hidden code gets planted on a legitimate website. When you visit that site, the malicious code loads in the background.

The webpage suddenly blurs and displays what looks like a standard CAPTCHA verification screen. But instead of just clicking a box to prove you’re human, this fake CAPTCHA tells you to open the Windows Run dialog box and paste in a specific command.

If you follow those instructions, you’re essentially launching the attack on yourself. That command downloads and installs the hacker’s malware directly onto your computer.

Remember this: A real CAPTCHA will never tell you to open Windows Run or paste commands into your computer. Never.

This tactic is called ClickFix, and it’s brilliant in its simplicity. The criminals aren’t relying on sophisticated hacking.

They’re counting on human psychology. You’re used to seeing CAPTCHAs all over the internet. You expect them on legitimate websites. So when one appears on a site you already trust, your guard drops.

The fake instructions make the dangerous action look like just another routine security step. That familiarity is what makes this scam so effective.

Criminals have used similar ClickFix tricks before with fake Windows update screens. The appearance changes, but the core deception stays the same — tricking you into running malicious commands that a webpage should never ask for.

The technical infrastructure behind this campaign makes it even harder to stop. The attackers are using something called the BNB Smart Chain test network to store instructions that the compromised websites follow.

Think of blockchain as a distributed record-keeping system. In this case, criminals are using it to store code that tells hacked websites what to do next.

Normally, when investigators find a criminal’s web server, they can get it shut down through the hosting company. But blockchain works differently.

The attackers store their malicious instructions inside what’s called a smart contract on the blockchain. The compromised websites check this smart contract for their marching orders.

They’re specifically using the test version of BNB Smart Chain, which developers normally use for experiments. That gives the criminals cheap infrastructure that’s much harder to take down through traditional law enforcement methods.

Even worse, the attacker can change what the smart contract delivers at any time. All the hacked websites automatically pick up those new instructions without the criminals having to touch each individual site again.

Security researchers have also discovered a newer version of this attack that skips the fake CAPTCHA entirely. This variant uses WebRTC technology, which your browser normally uses for video calls and real-time communications.

The criminal code creates an encrypted connection with the attacker through your browser. Malicious code gets delivered and can run without even being saved as a file on your computer first.

The technical details keep evolving, but the bottom line stays the same. Criminals are using a network of compromised legitimate websites to deliver malware, and they can change their tactics while using the same infrastructure.

Protecting yourself doesn’t require technical expertise. It just requires healthy skepticism and a few simple rules.

If any website tells you to open Windows Run, PowerShell, or Command Prompt, stop immediately. Don’t paste anything. Close that page.

A normal CAPTCHA might ask you to click a checkbox or identify pictures. It should never require you to change computer settings or run commands. If the instructions suddenly take you outside your browser, that’s your red flag.

Strong antivirus software can catch malicious scripts and malware if you make a mistake. Keep your antivirus updated and make sure real-time protection is turned on.

If you accidentally followed suspicious instructions from a fake CAPTCHA, disconnect your computer from the internet right away. Run a full antivirus scan immediately.

Then use a different trusted device to change passwords for any sensitive accounts you accessed on the infected computer. Start with your main email account, which criminals often target first.

Review active login sessions on your accounts and enable multi-factor authentication everywhere you can. That extra security layer makes it much harder for criminals to access your accounts even if they steal a password.

Install security updates when they become available, but only through official channels. Update Windows through Windows Update. Update your browser through its built-in settings or official website.

Never trust a random webpage that claims you need to download an update.

Small business owners need to take this threat seriously too. Researchers recommend checking the integrity of your content management system files. The malicious code has been found added to legitimate JavaScript files or hidden inside fake plugin directories.

Keep WordPress, PrestaShop, and all plugins updated. Remove any plugins you’re not actively using. Every unnecessary plugin is another potential entry point for hackers.

The researchers still haven’t identified exactly how attackers are breaking into these websites in the first place. That means even following security best practices doesn’t guarantee protection, though it certainly reduces your risk.

Wyatt Matters

This attack works because it weaponizes trust. You’re visiting a real business website — maybe your local clinic or the plumber who fixed your sink last month. That familiarity makes you vulnerable. The criminals are counting on Americans to let their guard down when they see a website they recognize. The blockchain infrastructure makes this harder for law enforcement to shut down, which means we can’t count on the authorities to protect us. We have to protect ourselves. One simple rule can save you: If a website tells you to paste commands into Windows Run, close that page immediately. No legitimate business will ever ask you to do that. Period. Small business owners are victims here too, but they need to take website security seriously. When your site gets compromised, it’s your customers who pay the price.