BNB Chain Fake CAPTCHAs Malware Campaign: Smart-Contract Commands Threaten Users and Enterprises

Microsoft Threat Intelligence says hackers are using BNB Chain smart contracts to spread malware via compromised websites and fake CAPTCHAs. The technique, reported as part of the ClickFix and TerminalFix methods, stores malicious instructions inside a blockchain contract, then retrieves them through a BNB Chain gateway. In attacks observed by Microsoft, JavaScript on infected sites contacts BNB Chain to pull commands previously linked to the ClearFake malware campaign. Victims are then shown a fake CAPTCHA that prompts them to open Windows Run (or Terminal/PowerShell) and paste attacker-supplied text, causing the malware to run on their devices. Microsoft warns that this approach is hard to remove because only the controlling wallet can update contract contents. A successful infection may steal credentials, establish persistent access, and help attackers move laterally inside networks—potentially leading to ransomware or wider compromise. Researchers also note that the use of blockchains for command-and-control is not new, citing earlier examples involving Bitcoin-based control and other blockchain-linked credential-stealers. The immediate relevance for traders is reputational and operational risk: BNB Chain-linked malware headlines can increase compliance and security scrutiny for Web3 firms, though the report does not point to a direct exploit draining BNB or changing protocol fundamentals. Still, the focus on BNB Chain in this malware workflow may affect sentiment around the ecosystem in the short term.