Hackers are using BNB Smart Chain contracts to store malware instructions.

Fake CAPTCHA prompts tell victims to paste malicious commands into Windows tools.

Successful attacks can steal credentials and give hackers lasting access to corporate networks.

Hackers are using BNB Chain contracts to spread malware through compromised websites and fake CAPTCHA prompts, according to a report by Microsoft Threat Intelligence.

In a post on X on Thursday, Microsoft Threat Intelligence said the campaign uses EtherHiding, a technique that stores malicious instructions in a blockchain smart contract. JavaScript injected into compromised websites contacts a BNB Chain gateway and retrieves commands from a contract previously linked to ClearFake, a malware campaign that infects legitimate websites.

Storing the instructions on a blockchain network makes them harder to remove. Only the wallet controlling the contract can change its contents, limiting the effectiveness of conventional takedowns. Public blockchain networks also provide multiple access points that cannot be individually blocked, since anyone can query a contract through different RPC providers or run their own node.

Visitors to compromised websites see a fake CAPTCHA telling them to open the Windows Run dialog, paste text from their clipboard, and press Enter. Doing so runs a command supplied by the attacker.

The method, known as ClickFix, depends on victims executing the malware themselves. A variation called TerminalFix directs users to Windows Terminal or PowerShell. ClickFix-style social engineering has been documented across multiple cybercrime operations, with attackers impersonating verification pages, software updates, and error dialogs to trick users into running code.

“This campaign demonstrates that ClickFix and TerminalFix are a high-volume initial access technique,” Microsoft researchers wrote. “Microsoft reports campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains can funnel visitors to scam pages.”

According to Microsoft, hackers hide their commands and abuse legitimate Windows tools, including PowerShell, cmd, mshta, rundll32, msiexec, curl, Windows Management Instrumentation, and scheduled tasks. A successful infection can expose passwords, establish lasting access, help hackers move through a network, and lead to ransomware or broader network compromise.

The use of blockchains to support malware attacks is not new.

In 2016, Cerber ransomware began using Bitcoin transactions to find its command-and-control servers. From 2019 to 2021, the Glupteba botnet used the Bitcoin blockchain to locate backup servers when its main ones went offline.

In September 2023, the ClearFake malware campaign began using EtherHiding to retrieve malicious code from BNB Chain smart contracts. In April 2026, researchers found Omnistealer using TRON, Aptos, and BNB Chain to help steal credentials, cloud account information, passwords, and crypto wallet data.

In other words, the problem is not unique to BNB Chain. But it is notable that Microsoft’s threat team has chosen to highlight what appears to be an ongoing issue.

The news comes after BNB Chain unveiled plans in July for a new layer-1 blockchain built for high-frequency trading, automated payments, and AI-driven transactions. A testnet is expected by the end of 2026, followed by a mainnet launch in early 2027.

Microsoft advised organizations to restrict unnecessary command-line tools, enable PowerShell logging, and use application controls. Because the malicious payload is fetched dynamically from blockchain infrastructure rather than hosted on a fixed server, conventional web filters and domain blocklists may offer limited protection against this delivery method.

“Users should never paste commands from CAPTCHAs, browser errors, emails, ads, or unsolicited support pages into Run, Terminal, PowerShell, or Command prompt,” Microsoft said.