Hackers are using BNB Chain contracts to spread malware through compromised websites and fake CAPTCHA prompts, according to Microsoft Threat Intelligence.
In a post on X on Thursday, Microsoft Threat Intelligence said the campaign uses EtherHiding, a technique that stores malicious instructions in a blockchain smart contract. JavaScript injected into compromised websites contacts a BNB Chain gateway and retrieves commands from a contract previously linked to ClearFake, a malware campaign that infects legitimate websites.
Putting those instructions on a blockchain makes them harder to remove. Only the wallet that controls the contract can modify its contents, which limits the effectiveness of standard takedown efforts.
Fake CAPTCHA pages push victims to run the command themselves
Visitors to compromised websites are shown a fake CAPTCHA that tells them to open the Windows Run dialog, paste text from their clipboard, and press Enter. That action executes a command supplied by the attacker.
The method is known as ClickFix and depends on victims launching the malware themselves. A related variation, called TerminalFix, directs users to Windows Terminal or PowerShell.
"This campaign demonstrates that ClickFix and TerminalFix are a high-volume initial access technique," Microsoft researchers wrote. "Microsoft reports campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains can funnel visitors to scam pages."
Microsoft says attackers are abusing legitimate Windows tools
According to Microsoft, hackers conceal their commands and abuse legitimate Windows utilities including PowerShell, cmd, mshta, rundll32, msiexec, curl, Windows Management Instrumentation, and scheduled tasks.
If the infection succeeds, it can expose passwords, establish persistent access, help attackers move through a network, and lead to ransomware or broader network compromise.
Blockchain-backed malware infrastructure has appeared before
Microsoft said the use of blockchains to support malware attacks is not new.
In 2016, Cerber ransomware began using Bitcoin transactions to locate its command-and-control servers. From 2019 to 2021, the Glupteba botnet used the Bitcoin blockchain to find backup servers when its main servers went offline.
In September 2023, the ClearFake malware campaign started using EtherHiding to pull malicious code from BNB Chain smart contracts. In April 2026, researchers found Omnistealer using TRON, Aptos, and BNB Chain to help steal credentials, cloud account information, passwords, and crypto wallet data.
Microsoft's point was that the issue is not unique to BNB Chain. Even so, the company's threat team chose to single out what it described as an apparently ongoing problem.
Security guidance from Microsoft
The report comes after BNB Chain unveiled plans in July for a new layer-1 blockchain designed for high-frequency trading, automated payments, and AI-driven transactions. A testnet is expected by the end of 2026, followed by a mainnet launch in early 2027.
Microsoft advised organizations to restrict unnecessary command-line tools, enable PowerShell logging, and use application controls.
"Users should never paste commands from CAPTCHAs, browser errors, emails, ads, or unsolicited support pages into Run, Terminal, PowerShell, or Command prompt," the company said.