The ClearFake campaign is now utilizing a technique called EtherHiding to store malicious payload instructions directly inside BNB Smart Chain (BSC) testnet smart contracts.
This shift replaces traditional command-and-control (C2) servers with decentralized blockchain infrastructure, making the routing layer immune to intervention by security vendors, domain registrars, or law enforcement.
By operating on the BSC testnet, threat actors enjoy the ultimate resilience of an immutable ledger while incurring absolutely zero operational costs.
The malicious contracts act as simple key-value stores featuring basic read and write functions.
An attacker updates the payload via a single on-chain transaction, and the new malicious code instantly propagates to every compromised website querying that contract.
ClearFake Abuses Blockchain C2
The intrusion begins when a user visits a compromised website, such as a legitimate WordPress blog. Threat actors inject a heavily obfuscated JavaScript loader directly into the site’s code.
Because the payload is delivered inline rather than via an external link, there is no malicious URL for security tools to flag or block.
A fascinating technical addition to this campaign is the use of a fourth smart contract dedicated purely to conversion tracking. This contract logs the public IP addresses of infected users via a geolocation API.
When the initial script runs, it checks this tracking contract to ensure it does not display the fake reCAPTCHA to an already compromised user, minimizing noise and reducing the chances of discovery.
According to Trendmicro research, the adoption of blockchain for C2 operations signals a maturity in cybercriminal tactics, matching capabilities previously seen only in state-sponsored groups like North Korea’s UNC5342.
The payload data lives inside contract storage across thousands of decentralized nodes simultaneously. You cannot sinkhole a blockchain, nor can you seize a smart contract.
This reality forces a strategic pivot for network defenders and threat intelligence analysts. Blocking IP addresses and malicious domains is no longer sufficient when the underlying infrastructure is decentralized and immutable.
Security teams must instead focus on behavioral analysis, strict endpoint controls, and user education regarding social engineering tactics.
Organizations are strongly advised to restrict user access to command-line interfaces and monitor for suspicious clipboard activities.
As threat actors continue to weaponize decentralized technologies, relying solely on traditional network indicators is a losing battle.
Defense strategies must evolve to detect the on-device behaviors that these immutable C2 networks inevitably trigger.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 testnet smart contracts.){kind=link}