BNB Chain Exploited for Malware Distribution via Fake CAPTCHAs

Hackers Exploit BNB Chain for Malware Distribution via Compromised Websites

New report from Microsoft Threat Intelligence reveals sophisticated attack leveraging blockchain for malicious code delivery.

Hackers are increasingly using BNB Chain smart contracts to distribute malware, employing a technique that embeds malicious instructions within blockchain transactions and delivers them through compromised websites and deceptive CAPTCHA prompts. This finding comes from a recent report by Microsoft Threat Intelligence.

The campaign, detailed in a post on X by Microsoft Threat Intelligence, utilizes a method known as EtherHiding. This technique involves storing malicious code within a smart contract on the BNB Chain. Malicious JavaScript, injected into compromised websites, then connects to a BNB Chain gateway to retrieve commands from a contract previously associated with ClearFake, a malware operation known for infecting legitimate websites.

The use of blockchain technology to store these instructions makes them significantly more difficult to remove. Only the digital wallet that controls the smart contract can alter its contents, undermining the effectiveness of traditional takedown efforts.

Visitors to compromised websites are presented with a fake CAPTCHA. This prompt instructs them to open the Windows Run dialog, paste text from their clipboard, and press Enter. Executing this action inadvertently runs a command supplied by the attacker.

This particular method, dubbed ClickFix, relies on the victim actively executing the malware. A variation, known as TerminalFix, directs users to open Windows Terminal or PowerShell to execute the malicious commands.

“This campaign demonstrates that ClickFix and TerminalFix are a high-volume initial access technique,” Microsoft researchers stated. “Microsoft reports campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains can funnel visitors to scam pages.”

According to Microsoft, attackers are adept at concealing their commands and abusing legitimate Windows tools. These include PowerShell, cmd, mshta, rundll32, msiexec, curl, Windows Management Instrumentation, and scheduled tasks. A successful infection can lead to the exposure of sensitive passwords, establish persistent access for attackers, facilitate lateral movement within a network, and ultimately result in ransomware attacks or broader network compromise.

The exploitation of blockchains to support malware attacks is not a new phenomenon. In 2016, the Cerber ransomware began using Bitcoin transactions to locate its command-and-control servers. Between 2019 and 2021, the Glupteba botnet similarly leveraged the Bitcoin blockchain to find backup servers when its primary ones became unavailable.

More recently, in September 2023, the ClearFake malware campaign began employing EtherHiding to retrieve malicious code from BNB Chain smart contracts. In April 2026, researchers identified Omnistealer utilizing TRON, Aptos, and BNB Chain to aid in the theft of credentials, cloud account information, passwords, and cryptocurrency wallet data.

While the problem is not exclusive to BNB Chain, Microsoft’s decision to highlight this ongoing issue underscores its significance.

This development comes as BNB Chain unveiled plans in July for a new layer-1 blockchain designed for high-frequency trading, automated payments, and AI-driven transactions. A testnet is anticipated by the end of 2026, with a mainnet launch scheduled for early 2027.

Microsoft has advised organizations to implement measures such as restricting the use of unnecessary command-line tools, enabling PowerShell logging, and employing application controls.

“Users should never paste commands from CAPTCHAs, browser errors, emails, ads, or unsolicited support pages into Run, Terminal, PowerShell, or Command prompt,” Microsoft cautioned.