Microsoft Threat Intelligence disclosed on August 6, 2026 that it has identified a cluster of compromised websites using a technique called EtherHiding to retrieve attack instructions from a smart contract on BNB Smart Chain, rather than from a server that could be taken down by defenders. The technique is associated with the ClearFake campaign, and Microsoft said attackers inject Base64-encoded JavaScript into hacked websites that queries the BNB Smart Chain RPC gateway for its next set of instructions.
What makes the approach resilient is baked into how blockchains work: only the wallet that originally deployed the contract can modify its contents, so conventional takedown or sinkholing methods that work against traditional command-and-control servers don't apply to a smart contract living permanently on-chain.
Fake CAPTCHAs are the entry point
Victims encounter the campaign through fake CAPTCHA verification pages that instruct them to paste a command into a Windows tool to "prove they're human." Instead of completing any verification, the pasted command silently launches malware — a social-engineering pattern known as ClickFix that has become increasingly common because it relies on victims running the malicious code themselves, sidestepping many endpoint defenses that watch for unauthorized downloads.
Related: BTCPay Server Warns of Critical Flaw Under Active Exploitation
What a successful infection leads to
Microsoft said successful infections can lead to credential theft, persistent access to the victim's machine, lateral movement across a network, and ultimately ransomware deployment — a full chain from a single fake CAPTCHA click to enterprise-wide compromise. The company advised organizations to restrict unnecessary command-line tools, enable PowerShell logging, and deploy application controls that block unauthorized scripts from executing.
Blockchain's resilience cuts both ways
EtherHiding is a reminder that the same properties making public blockchains attractive for legitimate finance — permanence, censorship resistance, no single point of failure — also make them a durable hosting layer for malicious infrastructure once attackers find a way to exploit it. Because BNB Smart Chain itself isn't compromised, only used as a resilient message board, there's no patch BNB Chain can ship to shut the campaign down; the fix has to come from browser vendors, endpoint security tools, and website operators closing the compromised-site entry points instead.
