Hackers exploit BNB Chain smart contracts to distribute malware via fake CAPTCHAs

Cybercriminals have found an unsettlingly clever use for blockchain’s most celebrated feature: immutability. A malware campaign identified by Microsoft Threat Intelligence is using smart contracts on the BNB Smart Chain to store and deliver malicious code, turning the network’s censorship resistance into a weapon against thousands of users daily. The campaign, known as ClickFix (also called TerminalFix), deploys fake CAPTCHA prompts on compromised websites to trick visitors into executing commands that install information-stealing malware on their Windows machines. How EtherHiding works The technical backbone of the operation is a technique called EtherHiding. Rather than hosting malicious payloads on traditional servers that security teams can identify and shut down, attackers embed their commands and configuration data directly into smart contracts deployed on the BNB Smart Chain. When a victim lands on a compromised website, typically a WordPress site that’s been quietly hijacked, injected JavaScript fires off a call to the blockchain. The smart contract returns Base64-encoded instructions, which the browser then decodes and executes. The compromised sites themselves don’t need ...