ClearFake Abuses BSC Testnet Contracts for Resilient C2 Operations

Threat actors behind the ClearFake campaign have adopted a novel and highly resilient command-and-control (C2) architecture by leveraging BNB Smart Chain (BSC) testnet smart contracts, creating an infrastructure that is effectively immune to traditional takedown efforts.

Unlike conventional malware campaigns that depend on easily disruptable infrastructure such as hosting providers or registrars, this approach embeds malicious JavaScript and instructions within immutable blockchain storage.

Once deployed, the data cannot be altered or removed, and is replicated across thousands of nodes. By operating on the BSC testnet, the attackers further reduce operational costs, as testnet tokens are freely available and carry no monetary value.

The attack chain begins with a compromised website, where a malicious base64-encoded JavaScript loader is injected directly into the page. This loader does not fetch payloads from external URLs.

Instead, it queries a BSC smart contract using a standard JSON-RPC eth_call request, retrieving the next-stage payload directly from on-chain storage. This design bypasses traditional URL-based detection and blocking mechanisms.

ClearFake significantly improves upon earlier EtherHiding techniques by storing the entire payload on-chain rather than just a reference link. Once retrieved, the malicious code executes entirely within the victim’s browser.

According to TrendAI Research, the attackers used the EtherHiding technique to store malicious payloads and routing logic directly inside blockchain smart contracts, eliminating reliance on domains or centralized servers.

The script includes anti-analysis checks to evade sandbox environments and filters out traffic from localhost or private IP ranges, ensuring only legitimate user systems are targeted.

ClearFake Abuses BSC Testnet

Victims who pass these checks are then routed based on their operating system. Windows users receive a ClickFix social engineering overlay that mimics a Google reCAPTCHA prompt, while macOS users are presented with a tailored version requiring terminal interaction. Both paths rely on clipboard hijacking to trick users into executing malicious commands.

The campaign delivers two primary payloads simultaneously. SectopRAT, a .NET-based remote access trojan, enables browser session hijacking and covert control of Chrome or Edge sessions.

ACRStealer, written in C++, focuses on extracting sensitive data including browser credentials, cryptocurrency wallets, messaging sessions, and FTP or VPN configurations.

On Windows systems, payloads are executed filelessly or via DLL sideloading techniques, while macOS infections use curl-based download and execution chains.

A particularly notable feature of this campaign is the use of a fourth smart contract as an execution tracker. This contract records successful infections in real time by storing victim identifiers derived from public IP addresses.

The malware checks this contract before displaying the lure, preventing reinfection and enabling attackers to monitor campaign effectiveness directly on-chain.

TrendAI identified four smart contracts involved in the operation, all linked to a single deployer wallet. The timeline shows the infrastructure has been active since at least May 2025, with continuous updates and new victim activity observed as recently as May 2026. This confirms that blockchain-based C2 is not experimental but part of an ongoing, maintained campaign.

Windows WebClient service loaded put34b.camp, a remote DLL with a non-standard .camp extension, directly into memory.

The contracts themselves are intentionally simple, functioning as key-value stores with basic set and get methods. This minimal design allows attackers to update payloads with a single transaction, instantly propagating changes to all infected or querying systems without requiring any additional infrastructure.

This development highlights a significant shift in attacker strategy. By leveraging decentralized and immutable platforms, threat actors are building C2 channels that cannot be seized, sinkholed, or disabled.

As blockchain-based abuse continues to evolve, defenders will need to focus more on behavioral detection, endpoint monitoring, and client-side protections rather than relying solely on infrastructure disruption.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.