Hackers Use BNB Chain to Spread Malware Through Fake CAPTCHAs

Hackers are using BNB Chain contracts to spread malware through compromised websites and fake CAPTCHA prompts, according to a report by Microsoft Threat Intelligence.

In a post on X on Thursday, Microsoft Threat Intelligence said the campaign uses EtherHiding, a technique that stores malicious instructions in a blockchain smart contract. JavaScript injected into compromised websites contacts a BNB Chain gateway and retrieves commands from a contract previously linked to ClearFake, a malware campaign that infects legitimate websites.

Storing the instructions on a blockchain network makes them harder to remove. Only the wallet controlling the contract can change its contents, limiting the effectiveness of conventional takedowns.

Visitors to compromised websites see a fake CAPTCHA telling them to open the Windows Run dialog, paste text from their clipboard, and press Enter. Doing so runs a command supplied by the attacker.

The method, known as ClickFix, depends on victims executing the malware themselves. A variation called TerminalFix directs users to Windows Terminal or PowerShell.

“This campaign demonstrates that ClickFix and TerminalFix are a high-volume initial access technique,” Microsoft researchers wrote. “Microsoft reports campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains can funnel visitors to scam pages.”

According to Microsoft, hackers hide their commands and abuse legitimate Windows tools, including PowerShell, cmd, mshta, rundll32, msiexec, curl, Windows Management Instrumentation, and scheduled tasks. A successful infection can expose passwords, establish lasting access, help hackers move through a network, and lead to ransomware or broader network compromise.

The use of blockchains to support malware attacks is not new.