More than 5,400 compromised small-business sites are being used to push ClickFix payloads, with the payload content described as living in smart contracts on BNB Smart Chain.