ClearFake Malware Uses BNB Smart Chain Testnet to Hide Its Command-and-Control Chain

ClearFake operators are using BNB Smart Chain testnet smart contracts to hide malware delivery instructions and make parts of their infrastructure harder to remove. The campaign uses compromised websites, injected JavaScript, fake CAPTCHA prompts, and ClickFix social engineering to push victims toward malware execution.

According to Trend Micro, the May 2026 intrusion used the EtherHiding technique to route ClearFake payload delivery through smart contracts on the BNB Smart Chain testnet. The chain delivered SectopRAT and ACRStealer, while a separate on-chain tracker confirmed victim compromise in real time.

The campaign shows how attackers continue to abuse trusted web traffic and decentralized infrastructure. Instead of relying only on a domain, server, or static payload URL, the injected script can query blockchain contracts and retrieve the next stage from data stored on-chain.

What ClearFake Is Doing Differently

ClearFake is not new, but its latest tactics make the campaign harder to disrupt with traditional blocking. Attackers compromise legitimate websites and inject JavaScript into their pages. Visitors can then see fake CAPTCHA or browser-style prompts designed to make them copy and run malicious commands.

Red Canary ranked ClearFake as the most prevalent threat in its May 2026 intelligence roundup. The company described it as an activity cluster that uses JavaScript injected into compromised websites, often with fake CAPTCHA lures and malicious copy-and-paste execution.

The newer Trend Micro case adds another layer. Four BNB Smart Chain testnet smart contracts shared one deployer wallet, with the oldest contract deployed nearly a year before analysis. That points to a maintained operation rather than a short-lived experiment.

ClearFake Attack Chain at a Glance

Stage	What Happens	Why It Matters
Website compromise	Attackers inject malicious JavaScript into legitimate websites.	Victims may trust the site because it appears normal.
Blockchain query	The script contacts BNB Smart Chain testnet smart contracts.	The next-stage instructions do not rely on a normal payload URL.
OS detection	The browser checks whether the visitor uses Windows or macOS.	The campaign can route victims to operating system-specific payloads.
ClickFix prompt	The victim sees a fake CAPTCHA or verification overlay.	The lure tricks users into running a malicious command themselves.
Payload delivery	The chain deploys SectopRAT and ACRStealer in the observed case.	Attackers can steal data, hijack sessions, and maintain access.

How EtherHiding Helps the Campaign

EtherHiding is a technique where attackers place malicious code or routing data inside public blockchain smart contracts. The compromised website does not need to contain the full payload or a visible malware download link.

Google Threat Intelligence Group previously reported that financially motivated actors have used EtherHiding to distribute infostealers through compromised WordPress sites. That research also described the technique as a way to obscure malicious code or data by placing it on a public blockchain such as BNB Smart Chain.

Trend Micro’s newer case used the BNB Smart Chain testnet, which lowers operating cost because testnet tokens carry no monetary value. It also gives attackers a resilient routing layer, since defenders cannot simply seize a central server to remove contract data already stored on-chain.

Why the BNB Smart Chain Testnet Matters

The BNB Smart Chain testnet is designed for developers to test blockchain applications. In this campaign, attackers abused that same availability to host routing logic and malicious JavaScript components.

The use of testnet infrastructure does not make the campaign unstoppable. Security teams can still block suspicious RPC endpoints, inspect injected website scripts, restrict risky browser behavior, and detect the later malware execution chain.

However, on-chain storage complicates takedowns. A normal malware campaign may depend on a domain registrar, hosting provider, or IP address. Here, the routing layer sits inside smart contracts that can remain readable even if other infrastructure disappears.

ClearFake Builds on Earlier Web3 Abuse

ClearFake has used blockchain-related tactics before. Sekoia.io reported in 2025 that ClearFake used compromised websites, Binance Smart Chain interactions, fake reCAPTCHA and Cloudflare Turnstile-style lures, and ClickFix tactics to trick users into running malicious PowerShell commands.

That history matters because the latest activity looks like an evolution of an existing framework. ClearFake began as a fake browser update threat, then shifted toward fake verification prompts and copy-and-run instructions.

The campaign’s use of Web3 infrastructure gives attackers more flexibility. They can update routing logic, check victim details, and point users toward payloads while hiding parts of the chain behind blockchain calls that may look less suspicious than malware downloads to some security products.

ClickFix Still Needs User Action

ClearFake does not rely only on technical tricks. It also depends on social engineering. Victims see a fake verification overlay that imitates a familiar CAPTCHA-style challenge.

Expel explained in January 2026 that ClearFake’s fake CAPTCHA flow can ask users to press Windows key + R, paste clipboard content, and press Enter. The page copies the malicious command to the clipboard before the user opens the Run window.

That step makes user awareness important. The attack can start from a legitimate hacked site, but the Windows chain still relies on convincing the user to execute a command under the false belief that it completes a browser check.

Payloads Seen in the Latest Campaign

Payload	Type	Main Risk
SectopRAT	.NET remote access trojan	Browser session hijacking and remote access
ACRStealer	C++ information stealer	Theft of passwords, cookies, credit card data, and crypto wallet data
Python-based loader components	Execution support tools	Silent execution and payload staging
On-chain tracker	Smart contract-based tracking	Confirmation of victim compromise

Trend Micro said the observed campaign delivered SectopRAT and ACRStealer at the same time. SectopRAT can support browser session hijacking, while ACRStealer targets sensitive browser and wallet data.

Red Canary also noted ACR Stealer’s appearance in recent ClearFake campaigns. It described ACR Stealer as a malware-as-a-service information stealer written in C++ and active since 2024.

What Security Teams Should Watch

• JavaScript injected into legitimate websites, especially WordPress sites.
• Browser traffic to unexpected BNB Smart Chain testnet RPC endpoints.
• Fake CAPTCHA pages that ask users to open the Windows Run dialog.
• Clipboard writes from web pages that coincide with verification prompts.
• Unusual use of rundll32.exe, dllhost.exe, PowerShell, or WebDAV-related execution.
• Unexpected folders or files pretending to belong to legitimate tools such as FileZilla.
• Signals of SectopRAT, ACRStealer, or browser credential theft modules.

Google Threat Intelligence Group reported that similar EtherHiding activity has affected compromised WordPress sites at scale. This makes web server monitoring as important as endpoint monitoring.

Organizations should also treat fake CAPTCHA execution as a high-priority training topic. The user may believe they are solving a verification check, but they are actually running attacker-supplied code.

How to Reduce Exposure

Security teams can block or inspect outbound JSON-RPC traffic to suspicious BNB Smart Chain testnet endpoints when business use does not require it. They can also restrict clipboard write access in managed browsers and disable the Windows WebClient service on workstations that do not need WebDAV.

Endpoint detection rules should flag suspicious process chains involving browser-launched scripts, rundll32.exe, dllhost.exe, PowerShell, and unexpected DLL loading. Web teams should scan websites for unfamiliar injected JavaScript, especially after plugin updates, CMS changes, or abnormal traffic spikes.

Sekoia.io previously found that ClearFake’s later variants used fake verification themes and additional Binance Smart Chain interactions. That pattern suggests defenders should expect the campaign to keep changing its lures and delivery paths.

Why This Campaign Matters

ClearFake shows how malware delivery has moved beyond simple malicious links. The campaign combines website compromise, blockchain-based routing, fake CAPTCHA prompts, copy-and-run social engineering, and information-stealing payloads.

The use of smart contracts does not remove every defensive option, but it does force defenders to think beyond domain takedowns. Blocking one URL may not stop a chain that can pull instructions from on-chain data and route victims dynamically.

Expel described ClearFake as a campaign that has adopted evasive living-off-the-land techniques and fake CAPTCHA lures across hacked websites. The latest BNB Smart Chain testnet activity reinforces the same trend: attackers are mixing familiar social engineering with infrastructure that is harder to remove quickly.

FAQ