Microsoft Exposes BNB Smart Chain Contracts Used to Deliver Malware Instructions

Microsoft Threat Intelligence has identified a sophisticated malware campaign using BNB Smart Chain contracts to deliver malicious instructions, a development that highlights unintended consequences of blockchain immutability.

The original report details how attackers are leveraging the EtherHiding technique to hide command-and-control logic in decentralized code that no centralized authority can easily remove.

Rather than hosting payloads on traditional servers that can be shut down, threat actors have moved communications to a permissionless smart contract environment, complicating takedown efforts.

The campaigns, tracked as ClickFix and TerminalFix, deploy fake CAPTCHA prompts on compromised websites. Users who click or follow on-screen instructions inadvertently execute malicious commands on their own machines.