ClearFake Malware Uses BSC Testnet Smart Contracts for Resilient C2

Key Takeaways

• The ClearFake malware campaign has adopted an innovative, highly resilient command-and-control (C2) infrastructure by utilizing smart contracts on the BNB Smart Chain (BSC) testnet.
• This blockchain-based C2 mechanism, dubbed “EtherHiding,” bypasses traditional takedown methods as there are no centralized servers, domains, or IP addresses to block.
• Victims are infected by visiting compromised legitimate websites that inject malicious JavaScript, leading to the delivery of potent malware such as SectopRAT (a remote access Trojan) and ACRStealer (an infostealer).
• The campaign leverages social engineering through a fake Google reCAPTCHA overlay, tricking users into executing commands that facilitate malware installation on both Windows and macOS systems.
• ClearFake has demonstrated significant longevity, with the oldest identified smart contract deployed nearly a year prior to its analysis, indicating a well-established and persistent operation.

ClearFake Malware Adopts Blockchain for Untraceable C2 Operations

The ClearFake malware campaign has significantly escalated its operational resilience by integrating blockchain smart contracts into its command-and-control (C2) architecture. This novel approach renders the campaign exceptionally difficult for cybersecurity professionals to disrupt or dismantle, marking a notable evolution in malware sophistication.

Unlike conventional malware that relies on centralized servers vulnerable to takedown actions, ClearFake’s operators have ingeniously embedded their C2 infrastructure within the decentralized BNB Smart Chain (BSC) testnet. This network’s inherent distributed nature makes it immune to seizure or suspension by any single authority, ensuring the malware’s persistent functionality. Further details of this technique were outlined in a report.

Infection Vector and Multi-Stage Delivery

The ClearFake campaign initiates infection through compromised legitimate websites, where attackers inject hidden JavaScript. Victims are not required to perform any suspicious actions; merely visiting a tampered site can trigger the malware’s sophisticated multi-stage delivery chain. In one documented instance from May 2026, an employee browsing a recreational website in Switzerland was silently infected through an automated attack sequence.

Researchers at Trend Micro meticulously analyzed this intrusion, revealing the full scope of the campaign. According to a report shared with Cyber Security News (CSN), the threat actors employed a technique called “EtherHiding” to store payload routing instructions directly within blockchain smart contracts. This method completely circumvents traditional URL-based blocking mechanisms, making detection and mitigation significantly more challenging.

Dual Payload Delivery: SectopRAT and ACRStealer

The attack chain is designed to deliver two highly dangerous tools simultaneously: SectopRAT and ACRStealer. SectopRAT is a .NET-based Remote Access Trojan (RAT) capable of hijacking browser sessions, providing attackers extensive control over the compromised system. ACRStealer, a C++ infostealer, is designed to harvest sensitive data, including passwords, credit card numbers, browser cookies, and cryptocurrency wallet information.

The malware intelligently routes victims to operating system-specific payloads. Real-time OS detection performed within the browser ensures that Windows users receive their tailored malicious components, while macOS users are directed to their corresponding payloads. This targeted approach maximizes the effectiveness of the infection across different platforms.

Longevity and Resilience of the Campaign

A particularly alarming aspect of this campaign is its confirmed longevity. Trend Micro identified four distinct smart contracts, all linked to a single deployer wallet. The oldest of these contracts was deployed nearly a year before the analysis in May 2026, demonstrating that this is not a transient experiment but a well-established and continuously operating threat. This long-term persistence underscores the attackers’ commitment to building a C2 infrastructure designed to withstand any attempts at takedown by law enforcement or cybersecurity vendors.

ClearFake Uses BSC Testnet Smart Contracts for Evasion

The EtherHiding technique functions by embedding malicious JavaScript directly within a smart contract on the BNB Smart Chain testnet, bypassing reliance on conventional web hosting. When a victim accesses a compromised website, injected code silently queries the blockchain to retrieve the full payload into the browser, all without involving any external URLs. Because blockchain data is globally replicated across thousands of nodes, there is no single server to shut down, no domain to seize, and no IP address to block, making the C2 infrastructure virtually indestructible.

ClearFake has further refined this technique by storing the entire JavaScript payload on-chain, rather than just a routing URL. The four identified smart contracts serve distinct functions:

• Smart Contract A: Delivers the anti-analysis dispatcher.
• Smart Contract B: Holds the Windows-specific “ClickFix” overlay.
• Smart Contract C: Contains the macOS-specific payload.
• Smart Contract D: Acts as an on-chain tracker, confirming each victim’s compromise in real-time.

Operating on the BSC testnet also offers a significant advantage to the attackers: it costs them nothing, as test BNB tokens hold no real monetary value, further reducing their operational overhead.

ClickFix Overlay and Social Engineering

Upon successful querying of the blockchain, victims are presented with a convincing, fake Google reCAPTCHA overlay featuring an “I’m not a robot” checkbox. Clicking this checkbox activates the “ClickFix” social engineering panel, which surreptitiously injects a malicious command directly into the victim’s clipboard.

Windows users are then prompted to open the Run dialog and paste the command. This action loads a remote DLL into memory without writing any file to disk, a technique designed to evade traditional file-based detection. Subsequently, a Python-based RAT and a shellcode loader are covertly installed within a directory disguised to resemble a legitimate FileZilla FTP client installation.

What You Should Do

• Block Outbound JSON-RPC Traffic: Configure firewalls to block outbound JSON-RPC traffic to BNB Smart Chain testnet RPC endpoints, particularly those starting with bsc-testnet-rpc.publicnode.com. This prevents the initial contract query step before any malicious payload can execute.
• Disable Windows WebClient Service: For workstations that do not require Web Distributed Authoring and Versioning (WebDAV) functionality, disable the Windows WebClient service. This mitigates the remote DLL loader delivery mechanism utilized by the malware.
• Implement Browser Management Policies: Enforce browser management policies that restrict clipboard write access. This measure can interrupt the “ClickFix” social engineering step, preventing victims from inadvertently executing injected commands.
• Conduct End-User Awareness Training: Regularly educate employees on the dangers of fake CAPTCHA prompts and “ClickFix” lures. Emphasize that the entire post-infection chain often relies on a single deliberate action from the victim, making user vigilance a critical first line of defense.
• Monitor for IoCs: Actively monitor your network for the provided Indicators of Compromise (IoCs) for any suspicious activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.