How the Attack Works: The EtherHiding Technique

The core innovation—and the reason this campaign is so difficult to disrupt—is the EtherHiding technique. Instead of relying on a traditional command-and-control server that can be taken down, attackers store malicious payload instructions directly inside BNB Smart Chain smart contracts . Because only the wallet address that deployed the contract can modify its content, removing the malicious instructions through traditional takedown or blocking methods is virtually impossible . This campaign overlaps with the ClearFake malware operation, which previously used fake browser update prompts to distribute malware .

The Infection Chain: From a Compromised Website to Malware

The attack unfolds in a relatively short sequence of steps that exploit user trust and built-in Windows tools:

1. Website Compromise – Attackers compromise legitimate websites (often WordPress sites) and inject Base64-encoded JavaScript into the page .
2. Blockchain Query – The injected script connects to a BNB Smart Chain RPC gateway and queries a specific smart contract to fetch the next-stage malicious instructions .
3. Fake CAPTCHA – The browser decodes the fetched instructions and displays a fabricated CAPTCHA verification screen to the user .
4. Social Engineering (ClickFix/TerminalFix) – The user is guided to press Windows+R to open the Run dialog (or open Windows Terminal or PowerShell), paste the command from their clipboard, and execute it . This is the key social engineering trick: it makes the victim an unwitting participant in the infection.
5. Malware Execution – The pasted command downloads and executes the final malware payload .

Abused Windows Tools (Living-off-the-Land)

To avoid detection, attackers extensively abuse legitimate, built-in Windows components—a technique known as "living-off-the-land" (LOLBins) . The tools observed in this campaign include:

• conhost – Console host used for command execution
• PowerShell – Script execution and download of payloads
• cmd (Command Prompt) – Direct command execution
• mshta – Running malicious HTA files
• rundll32 – Loading DLLs via the command line
• curl – Downloading next-stage payloads
• WMI (Windows Management Instrumentation) – For lateral movement or persistence
• Windows Run dialog – The initial execution point per the ClickFix lure

By using these trusted Microsoft components, attackers can bypass many traditional endpoint defenses .

Malware Families Delivered

This campaign is not limited to a single piece of malware. It serves as a delivery mechanism for a range of information-stealing and remote-access trojans :

• Lumma Stealer – The primary payload observed in many instances . It harvests browser passwords, cryptocurrency wallet credentials, session cookies, and other sensitive data.
• XWorm (Xworm) – A remote access trojan (RAT) capable of data theft and downloading additional payloads.
• AsyncRAT – An open-source RAT used for surveillance, keylogging, and credential theft.
• MintsLoader – A downloader/loader that installs additional malware onto the compromised system.
• Remote Management Tools – Potentially abused legitimate tools (e.g., AnyDesk, screen-sharing software) for persistence and lateral movement.

Successful execution can lead to credential exposure, establishing persistent access, lateral movement within a network, and eventual ransomware deployment . On macOS systems, the campaign has also been observed delivering MacSync and Atomic Stealer .

Microsoft's Recommended Defensive Measures

Microsoft has issued several practical recommendations to protect against this campaign :

1. Enable multi-layer protection in Microsoft Defender – Ensure real-time protection, cloud-delivered protection, and tamper protection are all active.
2. Restrict command-line tools – Use AppLocker or Windows Defender Application Control (WDAC) to block untrusted execution of tools like PowerShell, mshta, and rundll32.
3. Enable PowerShell script logging – Turn on script block logging and transcription to detect obfuscated command execution attempts.
4. User awareness (the most critical step) – Never paste commands from unknown or unverified sources into the Run dialog, Terminal, or PowerShell. A legitimate CAPTCHA will never instruct a user to perform any of these actions.
5. Block smart contract RPC endpoints – Where feasible, restrict outbound access to public BNB Smart Chain RPC gateways from endpoints that do not require blockchain access.
6. Use Microsoft Defender for SmartScreen – This tool helps block malicious webpages at the initial access stage, preventing the user from ever seeing the fake CAPTCHA .

Detection and Coverage

While the public advisory from Microsoft did not provide an exhaustive list of specific Microsoft Defender Antivirus detection names for this particular campaign , related security research from July and August 2026 indicates that Microsoft Defender for Endpoint provides behavioral coverage for :

• Living-off-the-land execution patterns
• Suspicious WebDAV and MSHTA activity
• Obfuscated PowerShell execution
• Scheduled-task persistence
• In-memory payload execution
• Browser credential theft

The macOS ClickFix blog published by Microsoft on August 5, 2026, documented that Microsoft Defender for SmartScreen blocks the malicious webpage, and Defender XDR provides surface coverage under specific tactic and technique mappings . Microsoft Defender Antivirus detections for the broader ClickFix threat family include names such as Behavior:Win32/ClickFix, Trojan:Win32/ClickFix, and Trojan:HTML/FakeCaptcha , though specific signatures for this campaign's BNB Chain-related JavaScript injections are deployed but were not individually named in the public warning .

How the Attack Works: The EtherHiding Technique

The core innovation—and the reason this campaign is so difficult to disrupt—is the EtherHiding technique. Instead of relying on a traditional command-and-control server that can be taken down, attackers store malicious payload instructions directly inside BNB Smart Chain smart contracts . Because only the wallet address that deployed the contract can modify its content, removing the malicious instructions through traditional takedown or blocking methods is virtually impossible . This campaign overlaps with the ClearFake malware operation, which previously used fake browser update prompts to distribute malware .

The Infection Chain: From a Compromised Website to Malware

The attack unfolds in a relatively short sequence of steps that exploit user trust and built-in Windows tools:

1. Website Compromise – Attackers compromise legitimate websites (often WordPress sites) and inject Base64-encoded JavaScript into the page .
2. Blockchain Query – The injected script connects to a BNB Smart Chain RPC gateway and queries a specific smart contract to fetch the next-stage malicious instructions .
3. Fake CAPTCHA – The browser decodes the fetched instructions and displays a fabricated CAPTCHA verification screen to the user .
4. Social Engineering (ClickFix/TerminalFix) – The user is guided to press Windows+R to open the Run dialog (or open Windows Terminal or PowerShell), paste the command from their clipboard, and execute it . This is the key social engineering trick: it makes the victim an unwitting participant in the infection.
5. Malware Execution – The pasted command downloads and executes the final malware payload .

Abused Windows Tools (Living-off-the-Land)

To avoid detection, attackers extensively abuse legitimate, built-in Windows components—a technique known as "living-off-the-land" (LOLBins) . The tools observed in this campaign include:

• conhost – Console host used for command execution
• PowerShell – Script execution and download of payloads
• cmd (Command Prompt) – Direct command execution
• mshta – Running malicious HTA files
• rundll32 – Loading DLLs via the command line
• curl – Downloading next-stage payloads
• WMI (Windows Management Instrumentation) – For lateral movement or persistence
• Windows Run dialog – The initial execution point per the ClickFix lure

By using these trusted Microsoft components, attackers can bypass many traditional endpoint defenses .

Malware Families Delivered

This campaign is not limited to a single piece of malware. It serves as a delivery mechanism for a range of information-stealing and remote-access trojans :

• Lumma Stealer – The primary payload observed in many instances . It harvests browser passwords, cryptocurrency wallet credentials, session cookies, and other sensitive data.
• XWorm (Xworm) – A remote access trojan (RAT) capable of data theft and downloading additional payloads.
• AsyncRAT – An open-source RAT used for surveillance, keylogging, and credential theft.
• MintsLoader – A downloader/loader that installs additional malware onto the compromised system.
• Remote Management Tools – Potentially abused legitimate tools (e.g., AnyDesk, screen-sharing software) for persistence and lateral movement.

Successful execution can lead to credential exposure, establishing persistent access, lateral movement within a network, and eventual ransomware deployment . On macOS systems, the campaign has also been observed delivering MacSync and Atomic Stealer .

Microsoft's Recommended Defensive Measures

Microsoft has issued several practical recommendations to protect against this campaign :

1. Enable multi-layer protection in Microsoft Defender – Ensure real-time protection, cloud-delivered protection, and tamper protection are all active.
2. Restrict command-line tools – Use AppLocker or Windows Defender Application Control (WDAC) to block untrusted execution of tools like PowerShell, mshta, and rundll32.
3. Enable PowerShell script logging – Turn on script block logging and transcription to detect obfuscated command execution attempts.
4. User awareness (the most critical step) – Never paste commands from unknown or unverified sources into the Run dialog, Terminal, or PowerShell. A legitimate CAPTCHA will never instruct a user to perform any of these actions.
5. Block smart contract RPC endpoints – Where feasible, restrict outbound access to public BNB Smart Chain RPC gateways from endpoints that do not require blockchain access.
6. Use Microsoft Defender for SmartScreen – This tool helps block malicious webpages at the initial access stage, preventing the user from ever seeing the fake CAPTCHA .

Detection and Coverage

While the public advisory from Microsoft did not provide an exhaustive list of specific Microsoft Defender Antivirus detection names for this particular campaign , related security research from July and August 2026 indicates that Microsoft Defender for Endpoint provides behavioral coverage for :

• Living-off-the-land execution patterns
• Suspicious WebDAV and MSHTA activity
• Obfuscated PowerShell execution
• Scheduled-task persistence
• In-memory payload execution
• Browser credential theft

The macOS ClickFix blog published by Microsoft on August 5, 2026, documented that Microsoft Defender for SmartScreen blocks the malicious webpage, and Defender XDR provides surface coverage under specific tactic and technique mappings . Microsoft Defender Antivirus detections for the broader ClickFix threat family include names such as Behavior:Win32/ClickFix, Trojan:Win32/ClickFix, and Trojan:HTML/FakeCaptcha , though specific signatures for this campaign's BNB Chain-related JavaScript injections are deployed but were not individually named in the public warning .