Cybercriminals have found an unsettlingly clever use for blockchain’s most celebrated feature: immutability. A malware campaign identified by Microsoft Threat Intelligence is using smart contracts on the BNB Smart Chain to store and deliver malicious code, turning the network’s censorship resistance into a weapon against thousands of users daily.
The campaign, known as ClickFix (also called TerminalFix), deploys fake CAPTCHA prompts on compromised websites to trick visitors into executing commands that install information-stealing malware on their Windows machines.
How EtherHiding works
The technical backbone of the operation is a technique called EtherHiding. Rather than hosting malicious payloads on traditional servers that security teams can identify and shut down, attackers embed their commands and configuration data directly into smart contracts deployed on the BNB Smart Chain.
When a victim lands on a compromised website, typically a WordPress site that’s been quietly hijacked, injected JavaScript fires off a call to the blockchain. The smart contract returns Base64-encoded instructions, which the browser then decodes and executes.
The compromised sites themselves don’t need to be modified repeatedly either. Once the initial JavaScript injection is in place, attackers can update their payloads by deploying new smart contracts or updating the ones they control on-chain. The infected website simply pulls the latest instructions from the blockchain each time a victim visits.
The payload: Lumma Stealer and credential theft
The end goal of these fake CAPTCHA prompts is delivering credential-stealing malware, with Lumma Stealer being the primary payload observed in the campaign. Lumma Stealer is a well-known information stealer capable of harvesting browser-stored passwords, cryptocurrency wallet credentials, session cookies, and other sensitive data from compromised machines.
The campaign targets both enterprise and consumer devices, which broadens the potential damage significantly.
The ClickFix campaign has been linked to the broader ClearFake initiative, a long-running operation that has used fake browser update prompts and similar social engineering lures since at least late 2025. Since being flagged in early August 2026, the pivot to fake CAPTCHAs represents an evolution in tactics.
Blockchain as infrastructure, not just currency
The BNB Smart Chain wasn’t designed to host malware. But its permissionless nature means anyone can deploy a smart contract containing arbitrary data, and nobody can force its removal. The same properties that make decentralized systems resistant to government censorship also make them resistant to cybersecurity intervention.
For individual users, the defensive advice is straightforward but worth repeating. Never execute commands from a CAPTCHA prompt, because legitimate CAPTCHAs never ask you to run anything on your machine. Keep browser extensions and operating systems updated. And if a WordPress site you visit suddenly starts behaving oddly, close the tab and don’t look back.