Microsoft exposes BNB smart chain contract used to deliver malware instructions

Microsoft Threat Intelligence detects malware activity using BNB smart contracts

Microsoft's Threat Intelligence team identified a highly complex malware activity in which an attacker used a BNB Smart Chain contract to deliver malicious instructions. This phenomenon highlights the unintended consequences of blockchain's immutable nature.

This attack technique is called "EtherHiding". The attacker hides command and control logic in decentralized code, making it difficult for any centralized organization to easily clear it. Unlike traditional reliance on servers that can be shut down, threat actors divert communications to a permission-free smart contract environment, making the removal operation more complex.

Microsoft traces these two activities as "ClickFix" and "TerminalFix" respectively. The attacker deployed fake CAPTCHA verification prompts on compromised websites. When users click or follow the on-screen instructions, they will inadvertently execute malicious commands on their own devices. According to Microsoft, these attacks target thousands of corporate and personal devices every day, making them one of the largest activities to use blockchain infrastructure as a relay. The victim's browser was tricked into running scripts to get instructions from the BNB Intelligent Chain's RPC gateway, a common node interface that anyone can query.

From fake CAPTCHA to malicious code

The chain of infection begins when users visit a tampered website. The page displays a realistic CAPTCHA verification window that requires the user to execute specific key combinations or copy commands to the terminal. Once the user does, the script will retrieve the payload for the next stage from the smart contract's data. This step completely strips malicious logic from the compromised server and places it on the blockchain without a single point of failure. The technology is efficient because it does not need to exploit vulnerabilities in the blockchain itself-it only needs to be able to read data from public contracts.

Traditional malware activity often relies on domain names, IP addresses, or cloud services, which can be tagged and offline. In contrast, the instructions stored in the BNB chain smart contract will continue to exist as long as the network is still running and the contract is still funded. Even if the original website is cleaned up, the same smart contract can be reused by other compromised sites. Microsoft's findings reveal a shift in attacker strategy: Criminal gangs are viewing public blockchain as cheap and resilient infrastructure.

BNB chains become unconscious infrastructure

The BNB chain consistently ranks among the most active networks in terms of number of developers, which in turn makes it a favored infrastructure for both legitimate projects and threat actors. The technology does not need to exploit any loopholes in blockchain consensus or security-it is simply a re-use of permission-free systems. The attacker treats the chain's RPC endpoints as a free, globally distributed Content Delivery Network for distributing malicious payload. Because these endpoints are public and necessary for the proper operation of the chain, directly blocking them would disrupt thousands of legitimate applications and users.

This is not the first time that blockchain networks have been misused for malware distribution. Historically, domain names, cloud storage buckets and even blockchain-like DNS projects have been used to obtain payload. However, the EtherHiding method turns smart contracts into permanent control channels. The validators that process blocks are not involved in the malware's functionality-they simply include transactions that store data. This means that the BNB Chain community faces a difficult cleanup dilemma: Any proposal to prune or review specific data will touch on the core principle of immutability.

Regulatory and Security Outlook

As U.S. lawmakers work to develop cryptocurrency regulations, with a bill that could reshape the industry just days away from a Senate vote, the banking community is pushing for last-minute changes. The discovery of malware may add urgency to the accountability debate over decentralized infrastructure, even though blockchain itself is not at fault.

The legislative battle shows that Washington has become concerned about risks in ecosystems. Attacks that use BNB chain smart contracts to infect thousands of devices may be cited by regulators to push for stricter controls on verifiers or RPC service providers.

How BNB chain developers and the wider community will respond remains uncertain. There is no simple "stop switch" for smart contracts that hold malicious instructions. Although a contract self-destruct mechanism exists, it requires an attacker to voluntarily include the feature, which is almost impossible. A more realistic path would be for browser developers, security companies, and wallet interfaces to build detection layers that flag interactions with known malicious contracts. Microsoft has coordinated such removal strategies with cybersecurity partners, but each new event forces people to rethink where the boundaries of Internet security should be.

The most direct warning for ordinary users is to be vigilant about CAPTCHA verification prompts that require abnormal operations, such as running terminal commands. An organization's security policy may need to be extended to block RPC endpoints for specific contracts, but this approach is rough at best. The attack vector transforms familiar network interactions into a malware delivery mechanism and leverages users 'inherent trust in blockchain infrastructure. The BNB chain ecosystem now finds itself at the intersection of technology adoption and criminal abuse, a tension that has become commonplace in public networks.