This threat involves the use of smart contracts on the BNB Smart Chain testnet as a persistent command-and-control (C&C) infrastructure by threat actors. They exploited the EtherHiding technique to embed ClearFake payload routing instructions within these contracts, making the C&C infrastructure immutable and resistant to takedown. The initial infection vector was JavaScript injected into a compromised Swiss website, which queried the blockchain contracts to retrieve malicious payloads. Victims passing anti-analysis checks were fingerprinted by operating system and redirected to platform-specific ClickFix social engineering overlays. The malware deployed includes SectopRAT, a .NET-based remote access trojan capable of browser session hijacking, and ACRStealer, a C++ infostealer targeting credentials and cryptocurrency wallets. An on-chain execution tracker provided real-time compromise confirmation. The presence of four smart contracts deployed by the same wallet, with the oldest nearly a year old, suggests a sustained and actively maintained campaign. No official patch or remediation is documented.

The threat enables persistent and immutable command-and-control infrastructure via blockchain smart contracts, complicating takedown efforts. It facilitates delivery of multiple malware families, including a remote access trojan and an infostealer targeting sensitive credentials and cryptocurrency wallets. Victims are fingerprinted and subjected to social engineering overlays, increasing the risk of credential theft and session hijacking. The long-running nature of the operation indicates ongoing risk to users interacting with compromised websites and blockchain environments.

No official patch or remediation guidance is available for this threat. Since the command-and-control infrastructure is hosted on immutable blockchain smart contracts, takedown is not feasible. Defenders should focus on preventing initial infection vectors such as compromised websites and malicious JavaScript injection. Monitoring for indicators of compromise related to SectopRAT and ACRStealer and educating users about social engineering overlays may help reduce impact. Check the referenced vendor advisory for any updates on mitigation.