Thousands of Small-Business Sites Are Serving a Fake CAPTCHA — Here's How to Check Yours

A customer forwards you a screenshot. It's your contact page — but blurred, with a box over the top saying "Verify you are human", and step-by-step instructions telling them to press the Windows key and R, paste something in, and hit Enter.

You open your own site. It looks completely normal.

That gap between what your visitors see and what you see is not an accident. It is the whole design.

What researchers actually found

Netskope Threat Labs published research in early September 2026 on a mass-compromise campaign it spotted from an odd signal: thousands of small-business websites were all quietly making the same request out to a blockchain endpoint.

Across the observation window, Netskope counted more than 5,400 distinct compromised sites, spanning more than 2,200 organisations worldwide, with several hundred live on any given day. BleepingComputer's 5 September 2026 write-up puts the August daily figure at around 400 sites, with an all-time peak of 536. The consumer-press version you may have seen — Fox News / Yahoo Tech, 13 September 2026 — is a syndication of the same research. The primary write-up is Netskope's own post.

The victims had almost nothing in common: clinics, plumbers, small e-commerce shops, no shared industry or region. What they mostly shared was the platform. Most of the examined sites were WordPress. Some were PrestaShop.

Two things are worth being blunt about before we go further.

Nobody knows how the attackers got in. Netskope says the initial compromise method remains unidentified. No plugin has been named. No CVE has been named. No host has been named. If you see an article confidently blaming a specific plugin for this campaign, it is ahead of the published evidence.

Your visitors are the target, not your database. This isn't a hack that steals your orders. It borrows your reputation — the fact that a stranger trusts your site enough to follow instructions on it — and spends it on infecting the people who came to hire you.

How the trick works

A compromised site gets a small piece of injected JavaScript, either dropped inline into the page or dressed up as a legitimate-looking file. That loader reaches out to a smart contract — a small program stored on a public blockchain — and pulls down the next stage of the attack from it.

This technique has a name: EtherHiding. It's popular with attackers for one practical reason. You cannot phone a hosting company or a domain registrar and have a blockchain contract taken down. And because every hacked site reads from the same contract, the attacker can change what all 5,400 of them deliver by editing one thing, instead of breaking back into thousands of sites.

What that contract returned, for most of this campaign, was a ClickFix lure. The page blurs, a fake CAPTCHA overlay appears, and the visitor is told to open the Windows Run dialog and paste a command to prove they're human. That command downloads and launches the malware.

The clever part is not technical. It's that the victim installs it themselves, by hand, after being told to — which sails past a lot of the protection that would have stopped a normal drive-by download.

Netskope also documented a newer variant that drops the fake CAPTCHA entirely and instead opens a WebRTC data channel — the technology your browser normally uses for video calls — to pull further code straight into memory. For a site owner, that variant changes nothing about what you should do. It just means "my visitors haven't complained" is weaker evidence than it used to be.

This is not the first time, which is the real lesson

Google's Threat Intelligence Group published research on 16 October 2025 about a group it tracks as UNC5142, running the same EtherHiding playbook through compromised WordPress sites. As of June 2025, Google flagged roughly 14,000 web pages carrying that group's injected JavaScript — though it noted it had seen no UNC5142 activity after 23 July 2025.

Different operator. Same trick. Which means "is my site quietly running someone else's script?" is not a one-off question you answer this month and forget. It belongs on the same list as your backups.

Why your site looks perfectly fine to you

This is the part most owners get caught by.

A separate but related Netskope report from late August 2026 describes a WordPress variant that was built specifically to hide from the site's owner. The injected code checks the visitor before it does anything, and stays completely silent if the visitor is a logged-in WordPress user, or is sitting on /wp-admin or /wp-login.php.

So the administrator — you — never sees the fake CAPTCHA. Only logged-out strangers do.

That variant also hid itself as a must-use plugin, in a folder called mu-plugins. A must-use plugin loads automatically on every page, cannot be switched off from the Plugins screen, and does not show up in your normal plugin list at all. Netskope's write-up names the file pattern as site-helper- followed by a string of random characters.

Worth being precise here: that report is a related campaign, not confirmed by researchers to be the same operator as the 5,400-site one. But the evasion design is the bit to take away, and it applies to both.

Six checks you can run yourself

None of these need a developer.

1. Look at your own site logged out. Open a private/incognito window — or better, your phone on mobile data with no WordPress session — and click through your home page, a service page, a blog post and your contact page. Watch for anything that blurs, overlays, or redirects.
2. Ask a Windows user. Much of this only fires on Windows. If your own machine is a Mac, you may genuinely never see it.
3. Open the network tab. In Chrome, right-click the page, Inspect, Network, then reload. You're scanning for requests going somewhere you don't recognise. Netskope's advice to corporate security teams is literally to block blockchain testnet RPC endpoints — so any traffic from your page to something that looks like a blockchain node is a red flag on a plumber's website.
4. Look in wp-content/mu-plugins/ using SFTP or your host's file manager. On most sites this folder is empty or doesn't exist, or holds one file your host put there deliberately. Anything else deserves a question to your host before you touch it.
5. Run two scanners, not one. One from outside (Sucuri SiteCheck or VirusTotal) and one from inside (the Wordfence or Sucuri plugin). WordPress.org's official guidance recommends both, because remote crawlers and on-server scanners find different things.
6. Check Google Search Console under Security Issues. If Google has already flagged you, that's not a maybe.

If you do find something

The official WordPress.org hacked-site guidance (last updated 26 July 2026) lays out a sequence. Condensed, and in the order that matters:

• Write down what you saw and when, including timezone, and what changed on the site recently. This becomes your incident record whether you clean it yourself or hand it to someone.
• Reset every access point, not just your password. WordPress users, SFTP/FTP, hosting control panel, database user. All admin accounts, not only yours.
• Rotate the secret keys in wp-config.php using the WordPress key generator. This is the step people skip, and it's the one that kicks out anyone still holding a logged-in session — including the attacker.
• Replace /wp-admin and /wp-includes with clean copies of the same version, dragged over by SFTP. Don't use the dashboard's re-install button: it overwrites existing files but leaves behind any new files the attacker added.
• Go through wp-content deliberately — theme files, plugin files, mu-plugins — and check .htaccess, which can exist in several directories, not just the root. Look hard at index.php, header.php, footer.php and functions.php.
• Update everything, then change all the passwords again once you're confident the site is clean.
• Work out how they got in. Otherwise you'll be doing this again in six weeks.

One honest caveat. Restoring a known-clean backup is usually faster and more reliable than hand-cleaning — if you have one and you know roughly when the injection started. If you don't know the date, a restore can cheerfully put the infection straight back, and you'll have lost the evidence that would have told you when it began.

What to do this week

1. Five minutes, incognito. Load your own site logged out, on two different devices, and click through four pages.
2. Look inside wp-content/mu-plugins/. Most owners have never opened it. It takes two minutes and it's exactly where this sort of thing likes to sit.
3. Run one external scan and register the site in Google Search Console so you get told next time.
4. Update WordPress core, plugins and themes, and delete anything you don't use. Since nobody has identified how these sites were breached, keeping the software current and the surface small is the honest best answer available.
5. Check you have a backup you could actually restore, and that you know its date.
6. Send your staff the one-line rule. No website ever needs you to paste a command into Windows Run.

Most of that is twenty minutes of your Tuesday. The hard part isn't any single step — it's that a site quietly serving malware to strangers gives its owner no reason to look, which is exactly why these campaigns run for months.

If you'd rather someone else did the looking — the logged-out checks, the file integrity scans, the backups that get tested rather than just taken — that's the ordinary, unglamorous work we do for the sites we look after. Either way, do step one today. It costs you five minutes and a private browsing window.