Hackers Abuse BNB Chain Smart Contracts to Push Malware Through Fake CAPTCHA Pages

A malware operation tracked by Microsoft Threat Intelligence is exploiting blockchain immutability to distribute malicious code at scale. The campaign stores and serves its payload through smart contracts on BNB Smart Chain, using the network's censorship-resistant design to make takedowns difficult and exposing thousands of users each day. Known as ClickFix (also referred to as TerminalFix), the scheme relies on compromised websites that display convincing fake CAPTCHA challenges. Visitors are prompted to run commands on their Windows devices, which leads to the installation of information-stealing malware. The mechanism, dubbed EtherHiding, replaces traditional attacker-controlled hosting with on-chain delivery. Instead of serving payloads from servers that defenders can identify and shut down, the actors embed commands and configuration data inside smart contracts deployed on BNB Smart Chain. When a victim lands on a hijacked site—often a WordPress installation that has been quietly compromised—injected JavaScript queries the blockchain. The contract responds with Base64-encoded instructions that the browser decodes and executes. Once the initial JavaScript injection is planted, the attackers can rotate or refresh what victims receive without repeatedly altering the website itself. They simply deploy new smart contracts or update contracts they control on-chain, and the infected site pulls the latest instructions each time a user visits. Microsoft observed Lumma Stealer as the primary payload. The credential-harvesting malware is known for stealing browser-saved passwords, cryptocurrency wallet credentials, session cookies and other sensitive data. By targeting both enterprise and consumer machines, the campaign expands the potential impact. ClickFix has been tied to the broader ClearFake activity cluster, a long-running operation that has used fake browser update prompts and related social engineering tactics since at least late 2025. After being flagged in early August 2026, the shift toward fake CAPTCHAs marks a tactical evolution. BNB Smart Chain was not built to host malware, but its permissionless model allows anyone to deploy a contract containing arbitrary data, and no central party can compel removal. The same properties that help decentralized networks resist censorship can also impede cybersecurity response. For users, the basic guidance remains unchanged: never run commands from a CAPTCHA prompt—legitimate CAPTCHAs do not require executing anything locally. Keep browsers, extensions and operating systems up to date. If a WordPress site suddenly behaves suspiciously, close the tab and move on.