Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet

Threat actors exploited the EtherHiding technique to store ClearFake payload routing instructions within smart contracts on the BNB Smart Chain testnet, creating an immutable command-and-control infrastructure that cannot be taken down. The attack began with injected JavaScript on a compromised Swiss website that queried blockchain contracts to deliver malicious payloads. Victims passing anti-analysis checks were fingerprinted by operating system and routed to platform-specific ClickFix social engineering overlays. The campaign simultaneously deployed SectopRAT, a .NET-based remote access trojan capable of browser session hijacking, and ACRStealer, a C++ infostealer targeting credentials and cryptocurrency wallets. An on-chain execution tracker confirmed each compromise in real time. Four smart contracts shared a single deployer wallet, with the oldest deployed nearly a year before analysis, indicating a long-running, actively maintained operation.

• September 2026 Infostealer Trend ReportMalware2026-10-28
• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• Uncovering a SectopRAT Variant Embedded in Legitimate SoftwareMalware2026-09-25
• RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser TheftMalware2026-09-24