Microsoft Finds Hackers Hiding Malware Commands in BNB Chain Smart Contracts

Hackers are using the BNB Chain blockchain to spread malware through compromised websites and fake CAPTCHA checks, Microsoft Threat Intelligence said. Microsoft's security team disclosed the campaign in a post on X on Thursday, August 6. The attackers trick victims into manually running a malicious command on their own Windows computer.

What Microsoft found

According to Microsoft Threat Intelligence, the campaign relies on a technique called EtherHiding: instructions for the malware are stored inside a blockchain smart contract. JavaScript injected into compromised websites contacts a BNB Chain gateway and pulls commands from a contract previously linked to the ClearFake campaign.

Storing the commands on the blockchain makes them harder to remove. Only the wallet controlling the contract can change its contents, so conventional takedown methods barely work against this kind of attack. The BNB Chain network itself is not technically compromised. Attackers are simply using the smart contract as a durable storage layer for commands that cannot be blocked without the owner's private key.

How the attack works

Visitors to compromised websites see a fake CAPTCHA prompt telling them to open the Windows Run dialog, paste text from their clipboard, and press Enter. Doing so runs a command supplied by the attacker.

The method is known as ClickFix and only works if the victim executes the malicious command themselves. A variant called TerminalFix directs users to Windows Terminal or PowerShell instead. These campaigns often disguise themselves as routine bot checks, so victims rarely suspect anything is wrong. The interface looks like an ordinary CAPTCHA that millions of people click through every day without thinking twice.

Not the first blockchain-based case

According to Microsoft, the attackers hide commands and abuse legitimate Windows tools: PowerShell, cmd, mshta, rundll32, msiexec, curl, as well as Windows Management Instrumentation and scheduled tasks. A successful infection can expose passwords, establish lasting access, help hackers move through a corporate network, and eventually lead to ransomware.

Using blockchains to support malware isn't a new practice. In 2016, the Cerber ransomware began using Bitcoin transactions to locate its command-and-control servers. Between 2019 and 2021, the Glupteba botnet turned to the Bitcoin blockchain to find backup servers whenever its main ones went offline.

In September 2023, the ClearFake campaign became the first to use EtherHiding to fetch malicious code from BNB Chain smart contracts. Then in April 2026, researchers discovered Omnistealer, malware that used the TRON, Aptos, and BNB Chain networks to steal credentials, cloud access, and crypto wallet data.

The problem, then, isn't unique to BNB Chain. Still, Microsoft's threat team chose to single out a practice that has been running for years.

What Microsoft recommends

The report landed shortly after BNB Chain unveiled plans in July for a new layer-1 blockchain built for high-frequency trading, automated payments, and AI-driven transactions. A testnet is expected by the end of 2026, with a mainnet launch planned for early 2027.

Microsoft advises organizations to restrict unnecessary command-line tools, enable PowerShell logging, and apply application control policies.

"Users should never paste commands from CAPTCHAs, browser error messages, emails, ads, or unsolicited support pages into the Run dialog, Terminal, PowerShell, or Command Prompt."

- Microsoft Threat Intelligence researchers, from a post on X dated August 6, 2026