BNB Smart Chain Used in Malware Campaign with Resistant Infrastructure

Microsoft has uncovered a new malware campaign centered around BNB Smart Chain that makes it harder for authorities to take down malicious infrastructure. The attackers have compromised legitimate websites and injected malicious JavaScript that communicates with a smart contract deployed on the blockchain.

The malware uses a technique called EtherHiding, linked to the notorious ClearFake malware operation. It retrieves its next-stage payload from a smart contract via a BNB Smart Chain RPC gateway.

The infrastructure is significantly more resistant to conventional takedown efforts because only the owner of the wallet that deployed the contract can modify or remove its contents.

Victims are then shown a fake CAPTCHA that instructs them to open the Windows Run dialog, paste clipboard contents, and execute an attacker-controlled command. Microsoft warned users never to paste commands from CAPTCHAs and recommended organizations enable Microsoft Defender's network, web, and cloud protections.