BNB Smart Chain Exploited in Malware Campaigns Targeting Users

Microsoft's Threat Intelligence has identified a malware campaign that uses the BNB Smart Chain to store and deliver malicious code. Hackers compromise legitimate websites by injecting JavaScript that connects to a smart contract on the blockchain.

The technique being used is called EtherHiding, which was previously linked to the ClearFake malware campaign that infected websites since late 2023. This method relies on victims running the malware themselves through fake CAPTCHA pages.

Once infected, devices can have passwords, browser data, and crypto wallet information stolen by various malware programs installed by attackers, including Lumma Stealer, XWorm, AsyncRAT, and MintsLoader. Microsoft warns that these tools can also give attackers lasting access to a device or network.