Thousands of legitimate small-business websites have been compromised to distribute malware through fake CAPTCHA prompts that trick users into running Windows commands. Netskope identified over 5,400 compromised sites across 2,200 organizations, with attackers using blockchain infrastructure to hide malicious instructions and evade detection.