ClearFake Uses BSC Smart Contracts and ClickFix Lures to Deliver Info-Stealers

Researchers reported that the long-running ClearFake/EtherHiding campaign is using compromised legitimate websites, fake Google reCAPTCHA pages, and ClickFix social-engineering lures to deliver malware through BNB Smart Chain testnet smart contracts rather than conventional staging servers. Analysis from Trend Micro and Censys found the attackers embedded obfuscated JavaScript and ethers.js on hacked sites, performed browser and OS checks, and retrieved victim-specific payload logic from on-chain contracts tied to a single deployer wallet. The infrastructure included contracts for anti-analysis dispatching, separate Windows and macOS delivery, and victim tracking, making traditional takedowns and URL blocking far less effective.

The campaign delivered SectopRAT and ACRStealer to steal passwords, cookies, browser sessions, credit card data, and cryptocurrency wallet information, while macOS infections also used dynamic resolver techniques through external web services to locate command-and-control endpoints and collect host data. A related stealer campaign described by Gurucul used software-search redirection, fake MEGA Transfer pages, a Go-based loader, and an Ethereum dead-drop resolver to obtain command-and-control infrastructure, underscoring a broader shift toward blockchain-backed malware delivery and resilient C2. Defenders were advised to monitor for unexpected ethers.js usage, fake CAPTCHA assets, clipboard-driven execution prompts, and access to BSC testnet JSON-RPC services, while training users to avoid fraudulent CAPTCHA and ClickFix prompts.