Microsoft Uncovers Malware Campaign Using BNB Chain to Evade Security Takedowns

Sophisticated Malware Campaign Weaponizes BNB Smart Chain

Microsoft Threat Intelligence has identified a coordinated malware campaign that strategically exploits BNB Smart Chain to establish resilient infrastructure for distributing malicious code while circumventing conventional security takedown mechanisms. The operation initiates when threat actors compromise legitimate websites and inject malicious JavaScript designed to communicate with smart contracts deployed on BNB Chain. This represents an innovative exploitation of blockchain technology, demonstrating how attackers continue to evolve their tactics to leverage emerging technologies and evade standard cybersecurity defenses. The campaign’s focus on blockchain infrastructure reveals the increasing sophistication of threat actors seeking to weaponize decentralized systems against end users.

EtherHiding Technique Enables Persistent Malware Infrastructure

The campaign employs a technique designated as EtherHiding, which originated from the ClearFake malware family. Rather than deploying malware on traditional servers vulnerable to removal and remediation, attackers utilize smart contracts on BNB Chain to host malicious payloads, retrieving them through the blockchain network’s RPC gateway. This architectural approach provides attackers with substantial operational advantages compared to conventional methods: because only the wallet owner who deployed the smart contract retains the ability to modify or delete its contents, the infrastructure becomes substantially more resistant to standard takedown procedures that typically target centralized hosting providers and internet infrastructure companies.

The attack deceives victims through deceptive CAPTCHA interfaces instructing users to open the Windows Run dialog, extract clipboard contents, and execute attacker-controlled commands. The malware implements extensive obfuscation techniques while abusing legitimate Windows utilities including PowerShell, Command Prompt, Windows Terminal, mshta, rundll32, WMI, curl, and WebDAV. Following successful execution, the malware can distribute multiple payload variants including Lumma Stealer, XWorm, AsyncRAT, MintsLoader, and remote administration tools. Compromised systems face credential exposure and heightened susceptibility to follow-up ransomware attacks orchestrated by human operators, potentially leading to significant financial and operational damage for affected organizations.

Security Recommendations and Expanding Cryptocurrency Threats

Microsoft advises users to refrain from executing commands originating from CAPTCHAs, browser notifications, advertisements, or email messages. Organizations should enable Microsoft Defender’s network, web, and cloud protections, restrict access to unnecessary command-line utilities, and activate PowerShell logging to detect suspicious activity. This warning reflects an escalating pattern of cryptocurrency-focused security threats throughout 2026: Microsoft disclosed a clipboard-interception campaign in June that replaced wallet addresses with attacker-controlled alternatives, and revealed a widespread cryptojacking operation combined with SEO poisoning techniques in preceding months. These incidents collectively demonstrate how the cryptocurrency ecosystem has emerged as an increasingly high-value target for sophisticated threat actors seeking financial gain and system compromise. The convergence of blockchain technology and malware delivery represents a novel challenge requiring updated security strategies from both individual users and enterprise organizations.

Source: Microsoft Threat Intelligence, via U.Today. Not financial advice.

This incident demonstrates why all blockchain participants must prioritize robust security practices, transaction verification, and awareness of emerging threats across cryptocurrency networks.