Crypto
Home›Crypto›Market Structure›Hackers use BNB Smart Chain contracts to deliver Windo…
Hackers use BNB Smart Chain contracts to deliver Windows malware
Microsoft Threat Intelligence says victims are lured via fake CAPTCHA prompts that trick them into pasting attacker commands into Windows tools, enabling credential theft and possible ransomware access.
Hackers are using BNB Smart Chain contracts to store and distribute malware instructions, Microsoft Threat Intelligence said. The technique relies on compromised websites injecting JavaScript that contacts a BNB Chain gateway and retrieves commands from a smart contract previously linked to the ClearFake malware campaign, Decrypt reported.
Microsoft said the campaign uses a method it describes as EtherHiding, which hides malicious instructions inside blockchain smart contracts. Researchers said this design can make cleanup harder because only the wallet controlling the contract can change its contents, reducing the effectiveness of conventional takedowns.
On infected pages, visitors see fake CAPTCHA prompts that direct them to open Windows Run, paste text copied to their clipboard, and press Enter, a method Microsoft calls ClickFix. A variant called TerminalFix directs users to Windows Terminal or PowerShell, and Microsoft said the approach is a high-volume initial access technique.
Microsoft warned that attackers combine the hidden instructions with legitimate Windows tools, including PowerShell, cmd, mshta, rundll32, msiexec, curl, Windows Management Instrumentation, and scheduled tasks. It said a successful infection can expose passwords, establish lasting access, and help lead to ransomware or broader network compromise, with similar tactics previously seen using Bitcoin transactions and the Bitcoin blockchain.
In 2016, Microsoft said Cerber ransomware began using Bitcoin transactions to find command-and-control servers, and from 2019 to 2021, the Glupteba botnet used the Bitcoin blockchain to locate backup servers. Microsoft also said the ClearFake campaign began using EtherHiding with BNB Chain smart contracts in September 2023, and that in April 2026 researchers found Omnistealer using TRON, Aptos, and BNB Chain to help steal credentials.
Latest closeBitcoin $64,802.26 ▲0.8%|BNB $591.87 ▲0.0%