Audit log

Every state-changing event for ClickFix BNB Chain EtherHiding Malware Campaign: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-08 23:16:05Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   aQcz63gjyRNy…tY4m9RGMcopysha256 → base58

   verifying row…

   canonical bytes (31962 B) ▸

   {"actor":"system:backfill","investigation_id":"c58c51ae-60d6-4f15-a903-2b8b38f90a55","kind":"publish","page_slug":"clickfix-bnb-chain-etherhiding-malware-campaign","published_at":"2026-08-08T23:16:05.553Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ClickFix BNB Chain EtherHiding Malware Campaign","sections":[{"content":"Microsoft Threat Intelligence publicly disclosed the campaign on August 7, 2026, identifying a cluster of compromised websites displaying ClickFix lures and using EtherHiding — a technique first associated with the ClearFake campaign in September 2023. The campaign reportedly targets thousands of enterprise and consumer Windows devices globally every day. Attackers inject Base64-encoded, XOR-encrypted JavaScript into compromised websites. Instead of retrieving payload instructions from a traditional command-and-control server, the injected script connects to a BNB Smart Chain RPC gateway and queries a smart contract previously linked to the ClearFake campaign to receive the next stage of the infection chain. Two lure variants are documented: ClickFix, which directs victims to the Windows Run dialog (Win+R), and TerminalFix, which directs victims to Windows Terminal or PowerShell. In both cases the victim is shown a fake CAPTCHA page requesting verification; the 'verification' instruction is in fact a malicious command pre-loaded into the clipboard by the injected JavaScript.","heading":"Campaign Overview","severity":"critical","sources":[{"credibility":2,"name":"Microsoft flags ClickFix malware using BNB Chain to fetch attack instructions — crypto.news","type":"news_article","url":"https://crypto.news/microsoft-flags-clickfix-malware-using-bnb-chain-to-fetch-attack-instructions/"},{"credibility":2,"name":"Hackers Use BNB Chain to Spread Malware Through Fake CAPTCHAs — Decrypt","type":"news_article","url":"https://decrypt.co/375133/hackers-use-bnb-chain-spread-malware-fake-captchas"},{"credibility":2,"name":"Microsoft Warns Hackers Are Exploiting BNB Chain to Distribute Malware — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/microsoft-warns-hackers-are-exploiting-bnb-chain-to-distribute-malware/"}]},{"content":"EtherHiding is a malware delivery technique in which attackers store malicious payload instructions — rather than on a conventional web server — inside the storage of a publicly readable smart contract deployed on a blockchain. The ClickFix campaign uses BNB Smart Chain (and in at least one documented intrusion, the BNB Smart Chain Testnet, Chain ID 97), making read calls via public RPC endpoints such as bsc-testnet.drpc.org and data-seed-prebsc-1-s1.bnbchain.org on port 8545. Because blockchain data is immutable and can only be changed by the contract deployer's private key, conventional abuse-report-based takedowns, domain seizures, or hosting provider action cannot neutralize the malicious infrastructure. Microsoft notes that 'only the owner of the cryptocurrency wallet that deployed the contract can modify its contents.' The technique was first documented at scale in the ClearFake campaign beginning in August–September 2023, when it was described by researchers as 'the next level of bulletproof hosting.' In October 2025, Google Threat Intelligence Group (GTIG) separately reported that the DPRK-linked threat actor UNC5342 had adopted EtherHiding for nation-state operations, marking the first documented state-sponsored use of the technique.","heading":"EtherHiding: On-Chain Payload Delivery","severity":"critical","sources":[{"credibility":2,"name":"Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign — The Hacker News (2023)","type":"news_article","url":"https://thehackernews.com/2023/10/binances-smart-chain-exploited-in-new.html"},{"credibility":2,"name":"One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion — Sicuranext","type":"research","url":"https://blog.sicuranext.com/one-paste-to-rule-them-all-inside-a-clickfix-etherhiding-guloader-intrusion/"},{"credibility":1,"name":"DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Cloud Blog","type":"research","url":"https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding"},{"credibility":2,"name":"Microsoft Warns Hackers Are Exploiting BNB Chain to Distribute Malware — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/microsoft-warns-hackers-are-exploiting-bnb-chain-to-distribute-malware/"}]},{"content":"A documented intrusion traced the full execution chain as follows. (1) A legitimate European small-business WordPress site was infected with the ErrTraffic v3 backdoor, deployed inside the WordPress mu-plugins directory with self-healing capabilities and a hidden admin account. (2) The injected JavaScript, encoded in Base64 and XOR-encrypted with a static key, contacts BNB Smart Chain Testnet via a standard eth_call request to retrieve the next payload stage. Multiple smart contracts store payload JavaScript, lure templates, sandbox-detection logic, and victim deduplication data. (3) Visitors on desktop Windows browsers are served a fake reCAPTCHA overlay. The overlay pre-loads a malicious command into the clipboard and instructs the user to press Win+R and paste the clipboard content. The command is heavily obfuscated using caret-character keyword fragmentation, environment variables to conceal interpreter names, and minimized or headless process execution. (4) Legitimate Windows utilities are abused to execute the payload without writing obvious artifacts to disk. Observed lolbin abuse includes: PowerShell, cmd, conhost, pcalua, mshta, rundll32 (with .google file extension spoofing and ordinal-based invocation via ,#1), msiexec, curl, WMI, WebDAV, and Windows scheduled tasks. UNC path delivery (SMB/WebDAV) is used to load DLLs remotely, bypassing Mark-of-the-Web metadata. (5) The final stage delivers one or more malware families from the payload set. Microsoft Defender Antivirus detects malicious command execution as Trojan:Win32/ClickFix.* and Trojan:Win32/TermFix.*. Hunt queries include detection of 'Suspicious command in RunMRU registry' and 'Possible initial access from an emerging threat.'","heading":"Attack Chain and Technical Execution","severity":"critical","sources":[{"credibility":2,"name":"One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion — Sicuranext","type":"research","url":"https://blog.sicuranext.com/one-paste-to-rule-them-all-inside-a-clickfix-etherhiding-guloader-intrusion/"},{"credibility":2,"name":"Microsoft flags ClickFix malware using BNB Chain to fetch attack instructions — crypto.news","type":"news_article","url":"https://crypto.news/microsoft-flags-clickfix-malware-using-bnb-chain-to-fetch-attack-instructions/"},{"credibility":2,"name":"ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA — CyberSecurityNews","type":"news_article","url":"https://cybersecuritynews.com/clickfix-campaign-uses-etherhiding-and-guloader/"}]},{"content":"Microsoft identified five categories of payloads deployed post-execution in the August 2026 campaign disclosure: (1) Lumma Stealer — an information stealer targeting browser credentials, cookies, cryptocurrency wallet files, and two-factor authentication data; (2) XWorm — a remote access trojan providing persistent backdoor access; (3) AsyncRAT — a .NET-based remote access trojan used for surveillance, keylogging, and lateral movement; (4) MintsLoader — a lightweight loader used to fetch and execute additional second-stage payloads; and (5) unspecified remote management tools. Earlier campaign variants delivered GULoader, a shellcode-based in-memory loader commonly used to drop infostealers including RedLine and Vidar, and RATs such as Remcos and AgentTesla. A separate but related April 2026 campaign variant used the credential stealer Omnistealer, which leveraged TRON, Aptos, and BNB Chain for payload delivery to steal passwords, cloud account data, and crypto wallet contents. The macOS-targeting ClickFix variant, documented by Huntress in August 2026, deployed a Go-based infostealer capable of intercepting and partially redirecting cryptocurrency transactions without fully emptying wallets, making detection more difficult.","heading":"Deployed Malware Families","severity":"critical","sources":[{"credibility":2,"name":"BNB Chain Malware Warning Names 5 Payload Types — COINOTAG","type":"news_article","url":"https://en.coinotag.com/bnb-chain-malware-warning-names-5-payload-types"},{"credibility":2,"name":"ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA — CyberSecurityNews","type":"news_article","url":"https://cybersecuritynews.com/clickfix-campaign-uses-etherhiding-and-guloader/"},{"credibility":2,"name":"ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html"},{"credibility":2,"name":"Hackers Use BNB Chain to Spread Malware Through Fake CAPTCHAs — Decrypt","type":"news_article","url":"https://decrypt.co/375133/hackers-use-bnb-chain-spread-malware-fake-captchas"}]},{"content":"CryptoBandits (detected as Trojan:Win32/CryptoBandits.A) is a clipboard-hijacking and worm-propagation malware family separately disclosed by Microsoft on June 17, 2026 and noted in connection with payload delivery in this campaign cluster. The malware polls the Windows clipboard approximately every 500 milliseconds, scanning for patterns matching cryptocurrency wallet addresses or seed phrases. When a match is detected, it silently replaces the copied address with an attacker-controlled address before the user pastes it, redirecting any subsequent transaction to the attacker's wallet without the user's awareness. CryptoBandits also extracts seed phrases and private keys stored or accessible on the infected system. For persistence and propagation, it scans connected USB devices and creates malicious shortcut (.lnk) files mimicking legitimate files, enabling worm-like lateral spread. Command-and-control communications are routed through a bundled portable Tor client via a local SOCKS5 proxy on localhost:9050, obscuring C2 traffic and reducing DNS-level visibility. Microsoft reported the campaign has been active since at least February 2026 and is distributed via malicious .lnk payloads. The 500-millisecond polling interval and Tor-based C2 are confirmed technical characteristics documented by SecurityWeek.","heading":"CryptoBandits: Crypto Clipboard Hijacker","severity":"critical","sources":[{"credibility":1,"name":"Crypto Clipper uses Tor and worm-like propagation for persistence and control — Microsoft Security Blog","type":"official","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/"},{"credibility":2,"name":"CryptoBandits Malware Doubles as a Backdoor, Abuses Tor — SecurityWeek","type":"news_article","url":"https://www.securityweek.com/cryptobandits-malware-doubles-as-a-backdoor-abuses-tor/"},{"credibility":2,"name":"Microsoft Warns Windows USB Worm CryptoBandits Is Hijacking Bitcoin Addresses — TFTC","type":"news_article","url":"https://www.tftc.io/cryptobandits-usb-worm-hijacks-bitcoin-clipboard-windows/"},{"credibility":2,"name":"Microsoft identifies malware 'worm' that hijacks crypto wallets, spreads through USB drives — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/06/19/microsoft-found-malware-that-hijacks-crypto-wallets-and-spreads-through-usb-sticks"}]},{"content":"The defining characteristic of this campaign that elevates it above conventional malware infrastructure is the use of public blockchain smart contracts as payload hosting. Once a smart contract is deployed on BNB Smart Chain, its stored data is permanently part of the chain's history and can only be overwritten by a transaction signed by the deploying wallet's private key. Law enforcement, hosting providers, domain registrars, and CERT teams have no mechanism to alter or remove the data. Microsoft noted that the architecture makes the instructions 'difficult to remove using conventional takedown or sinkholing methods.' Security researchers characterize this as a form of 'bulletproof hosting' that is both cheap to deploy and immune to the abuse-report processes that neutralize conventional attacker infrastructure. The same technique has now been adopted by nation-state actors (DPRK's UNC5342, per Google GTIG, October 2025), suggesting that its resilience characteristics are being recognized across the threat actor spectrum. The legitimate appearance of BNB Chain RPC traffic — transiting through CDN providers including Cloudflare and Amazon — further complicates network-level detection.","heading":"Why Traditional Takedowns Are Ineffective","severity":"critical","sources":[{"credibility":2,"name":"Microsoft flags ClickFix malware using BNB Chain to fetch attack instructions — crypto.news","type":"news_article","url":"https://crypto.news/microsoft-flags-clickfix-malware-using-bnb-chain-to-fetch-attack-instructions/"},{"credibility":1,"name":"DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Cloud Blog","type":"research","url":"https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding"},{"credibility":2,"name":"One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion — Sicuranext","type":"research","url":"https://blog.sicuranext.com/one-paste-to-rule-them-all-inside-a-clickfix-etherhiding-guloader-intrusion/"}]},{"content":"For individuals holding or transacting cryptocurrency, this campaign presents a direct, silent financial threat. The clipboard hijacking component (CryptoBandits) operates entirely without user-visible indicators: an address copied from a wallet application or exchange is replaced within milliseconds before the user pastes it into a transaction confirmation field. The 500-millisecond polling interval means there is no practical window for manual verification between copy and paste. Hardware wallets that display and independently confirm the destination address on the hardware device itself are documented as an effective mitigation, since the signed transaction is constructed by the hardware without trusting the host clipboard. Software wallet users are advised to manually verify wallet addresses character-by-character — particularly the first and last four characters — before confirming any transaction. A successful full compromise also exposes browser-stored credentials, cloud account tokens, and seed phrases, creating second-order risk of total wallet drainage independent of any individual transaction.","heading":"Downstream Risk to Crypto Users","severity":"critical","sources":[{"credibility":2,"name":"CryptoBandits Malware Doubles as a Backdoor, Abuses Tor — SecurityWeek","type":"news_article","url":"https://www.securityweek.com/cryptobandits-malware-doubles-as-a-backdoor-abuses-tor/"},{"credibility":2,"name":"Microsoft flags 'CryptoBandits' malware draining wallets — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/microsoft-flags-cryptobandits-malware/"},{"credibility":2,"name":"Trojan:Win32/CryptoBandits.A USB Clipper Warning — Gridinsoft","type":"research","url":"https://blog.gridinsoft.com/trojan-win32-cryptobandits-usb-crypto-clipper/"}]},{"content":"Microsoft Threat Intelligence stated that campaigns using this infrastructure are 'targeting thousands of enterprise and consumer devices globally every day.' The campaign's macOS extension, documented separately in August 2026, indicates cross-platform expansion beyond the Windows-focused initial disclosure. More than 250 ClickFix domains using browser fingerprinting to serve macOS-targeted malware lures were documented by The Hacker News in August 2026. A successful enterprise compromise can result in credential theft enabling lateral movement, persistent backdoor access, and a pathway to human-operated ransomware deployment including potential full domain compromise. The Omnistealer variant documented in April 2026 demonstrates that the EtherHiding distribution model is being adopted by multiple independent threat actors, not a single campaign operator.","heading":"Scope and Scale","severity":"high","sources":[{"credibility":2,"name":"Hackers Use BNB Chain to Spread Malware Through Fake CAPTCHAs — Decrypt","type":"news_article","url":"https://decrypt.co/375133/hackers-use-bnb-chain-spread-malware-fake-captchas"},{"credibility":2,"name":"Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser-fingerprinting-to-hide-macos-malware-lures.html"},{"credibility":2,"name":"Microsoft Flags BNB Chain Malware Campaign Targeting Windows Users — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33260272/"}]},{"content":"The following indicators of compromise (IoCs) were documented by Sicuranext in their analysis of a confirmed ClickFix-EtherHiding-GULoader intrusion. Network indicators: GULoader C2 domain autum-path[.]vo8xalon[.]in[.]net resolving to 188.114.96.7 and 188.114.97.7 via Cloudflare; EtherHiding RPC endpoint bsc-testnet[.]drpc[.]org; BNB Smart Chain Testnet fallback RPC data-seed-prebsc-1-s1[.]bnbchain[.]org on port 8545. File indicator: remote DLL path \\autum-path[.]vo8xalon[.]in[.]net\\05fe317c-0981-4de2-bc8a-930d369db441\\ck-3d80df5d12cdfe6450a782fc87bf66b444.google (file extension spoofed as .google). Hash: SHA-256 172a25a9ed8b798d8baeec29424b46627b5b39723b37c787f928d3700509001e (web content). Behavioral detection: process rundll32.exe with command line matching pattern (* #*) or (*,#*). Microsoft Defender detections: Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/CryptoBandits.A. These IoCs are presented as documented and may not represent the full current infrastructure of an active campaign.","heading":"Indicators of Compromise","severity":"high","sources":[{"credibility":2,"name":"One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion — Sicuranext","type":"research","url":"https://blog.sicuranext.com/one-paste-to-rule-them-all-inside-a-clickfix-etherhiding-guloader-intrusion/"},{"credibility":2,"name":"Microsoft flags ClickFix malware using BNB Chain to fetch attack instructions — crypto.news","type":"news_article","url":"https://crypto.news/microsoft-flags-clickfix-malware-using-bnb-chain-to-fetch-attack-instructions/"}]},{"content":"Microsoft recommends that organizations treat Trojan:Win32/ClickFix.* and Trojan:Win32/TermFix.* detections as indicators of a possible initial access incident and immediately isolate affected devices for investigation. Recommended defensive measures include: restricting or auditing use of unnecessary command-line utilities (PowerShell, mshta, rundll32, msiexec, curl) via application control policies; enabling detailed PowerShell script block logging and forwarding logs to a SIEM; deploying EDR behavioral rules to detect rundll32.exe invocations with ordinal-based arguments (patterns ,#1 or #); hunting RunMRU registry keys for suspicious pasted commands; auditing mu-plugins directories on WordPress sites for unexpected files; and requiring hardware wallet address verification for all cryptocurrency transactions. For cryptocurrency users specifically: hardware wallets that display the recipient address independently of the host computer are documented as effective against the clipboard-hijacking component. Software-only wallet users should verbally verify wallet addresses before confirming transactions rather than relying on clipboard accuracy.","heading":"Detection and Mitigation Guidance","severity":"medium","sources":[{"credibility":2,"name":"Microsoft flags ClickFix malware using BNB Chain to fetch attack instructions — crypto.news","type":"news_article","url":"https://crypto.news/microsoft-flags-clickfix-malware-using-bnb-chain-to-fetch-attack-instructions/"},{"credibility":2,"name":"Microsoft Warns Hackers Are Exploiting BNB Chain to Distribute Malware — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/microsoft-warns-hackers-are-exploiting-bnb-chain-to-distribute-malware/"},{"credibility":1,"name":"Think before you Click(Fix): Analyzing the ClickFix social engineering technique — Microsoft Security Blog","type":"official","url":"https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/"}]},{"content":"The EtherHiding technique was first documented by Guardz in October 2023 in the context of the ClearFake campaign (also tracked as UNC5142 by some researchers), which used fake browser update overlays on compromised WordPress sites. At that time, payloads included Amadey, Lumma, and RedLine stealers. The pivot to blockchain-hosted payloads came after prior ClearFake infrastructure was disrupted when it relied on abused Cloudflare Workers. By storing payload JavaScript directly on-chain rather than at a URL, the operators obtained an infrastructure layer immune to the previous disruption method. The August 2026 campaign represents a continuation and elaboration of this same technique, now combined with the ClickFix social engineering vector (which instructs users to self-execute malware through fake CAPTCHA pages) first documented at scale in 2024–2025. In October 2025, Google GTIG reported North Korean state actor UNC5342 adopted EtherHiding for their fake job interview campaigns targeting software developers, demonstrating that the technique has proliferated from financially motivated cybercriminal groups to state-sponsored actors. The April 2026 Omnistealer campaign extended the on-chain payload model to TRON and Aptos blockchains in addition to BNB Chain, suggesting further diversification of infrastructure.","heading":"Historical Context and Technique Evolution","severity":"medium","sources":[{"credibility":2,"name":"Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign — The Hacker News","type":"news_article","url":"https://thehackernews.com/2023/10/binances-smart-chain-exploited-in-new.html"},{"credibility":3,"name":"ClearFake Malware Campaign — Medium (KanakSasak)","type":"community_report","url":"https://kanaksasak.medium.com/clearfake-malware-campaign-e1f8e63dd30b"},{"credibility":2,"name":"North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html"},{"credibility":1,"name":"DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Cloud Blog","type":"research","url":"https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding"}]}],"sources_used":[{"credibility":2,"name":"Microsoft flags ClickFix malware using BNB Chain to fetch attack instructions — crypto.news","type":"news_article","url":"https://crypto.news/microsoft-flags-clickfix-malware-using-bnb-chain-to-fetch-attack-instructions/"},{"credibility":2,"name":"Hackers Use BNB Chain to Spread Malware Through Fake CAPTCHAs — Decrypt","type":"news_article","url":"https://decrypt.co/375133/hackers-use-bnb-chain-spread-malware-fake-captchas"},{"credibility":2,"name":"Microsoft Warns Hackers Are Exploiting BNB Chain to Distribute Malware — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/microsoft-warns-hackers-are-exploiting-bnb-chain-to-distribute-malware/"},{"credibility":2,"name":"Microsoft Flags BNB Chain Malware Campaign Targeting Windows Users — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/security/33260272/"},{"credibility":2,"name":"ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA — CyberSecurityNews","type":"news_article","url":"https://cybersecuritynews.com/clickfix-campaign-uses-etherhiding-and-guloader/"},{"credibility":2,"name":"One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion — Sicuranext","type":"research","url":"https://blog.sicuranext.com/one-paste-to-rule-them-all-inside-a-clickfix-etherhiding-guloader-intrusion/"},{"credibility":1,"name":"Crypto Clipper uses Tor and worm-like propagation for persistence and control — Microsoft Security Blog","type":"official","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/"},{"credibility":2,"name":"CryptoBandits Malware Doubles as a Backdoor, Abuses Tor — SecurityWeek","type":"news_article","url":"https://www.securityweek.com/cryptobandits-malware-doubles-as-a-backdoor-abuses-tor/"},{"credibility":2,"name":"Microsoft identifies malware 'worm' that hijacks crypto wallets, spreads through USB drives — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/06/19/microsoft-found-malware-that-hijacks-crypto-wallets-and-spreads-through-usb-sticks"},{"credibility":1,"name":"DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Cloud Blog","type":"research","url":"https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding"},{"credibility":2,"name":"North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html"},{"credibility":2,"name":"Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign — The Hacker News (2023)","type":"news_article","url":"https://thehackernews.com/2023/10/binances-smart-chain-exploited-in-new.html"},{"credibility":2,"name":"ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html"},{"credibility":2,"name":"Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser-fingerprinting-to-hide-macos-malware-lures.html"},{"credibility":1,"name":"Think before you Click(Fix): Analyzing the ClickFix social engineering technique — Microsoft Security Blog","type":"official","url":"https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/"},{"credibility":2,"name":"Microsoft flags 'CryptoBandits' malware draining wallets — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/microsoft-flags-cryptobandits-malware/"},{"credibility":2,"name":"North Korean hackers use EtherHiding to hide malware on the blockchain — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/"},{"credibility":2,"name":"Microsoft Warns Hackers Are Using BNB Chain to Spread Malware — U.Today","type":"news_article","url":"https://u.today/microsoft-warns-hackers-are-using-bnb-chain-to-spread-malware"}],"summary":"An active malware campaign, publicly disclosed by Microsoft Threat Intelligence on August 7, 2026, combines ClickFix-style fake CAPTCHA social engineering with the EtherHiding technique to store malicious payload instructions inside BNB Smart Chain smart contracts. Because the payload hosting is on-chain and can only be modified by the deployer's private key, traditional DNS and hosting takedowns are ineffective against the attack infrastructure. Deployed payloads include information stealers, remote access trojans, and a crypto clipboard hijacker (CryptoBandits) that silently replaces copied wallet addresses with attacker-controlled ones every 500 milliseconds.","timeline":[{"date":"2023-08-01","event":"ClearFake campaign begins using EtherHiding technique on BNB Smart Chain, storing malicious payload JavaScript inside on-chain smart contracts. Guardz researchers later document this as the first known EtherHiding campaign.","source":"The Hacker News","source_url":"https://thehackernews.com/2023/10/binances-smart-chain-exploited-in-new.html"},{"date":"2023-10-16","event":"The Hacker News and Guardz publicly document the EtherHiding technique for the first time, describing it as 'the next level of bulletproof hosting' and attributing it to the ClearFake campaign targeting WordPress sites.","source":"The Hacker News","source_url":"https://thehackernews.com/2023/10/binances-smart-chain-exploited-in-new.html"},{"date":"2025-10-01","event":"Google Threat Intelligence Group (GTIG) reports that DPRK-linked threat actor UNC5342 has adopted the EtherHiding technique in fake job interview social engineering campaigns targeting software developers, marking the first documented nation-state use of the technique.","source":"Google Cloud Blog","source_url":"https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding"},{"date":"2026-02-01","event":"CryptoBandits malware campaign begins activity, distributing clipboard-hijacking and USB-worm components via malicious .lnk payloads. Microsoft later identifies the campaign as active from at least February 2026.","source":"Microsoft Security Blog","source_url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/"},{"date":"2026-04-01","event":"Researchers discover the Omnistealer campaign using TRON, Aptos, and BNB Chain blockchains for on-chain payload delivery to steal credentials, cloud account data, passwords, and cryptocurrency wallet contents, demonstrating multi-chain expansion of the EtherHiding model.","source":"Decrypt","source_url":"https://decrypt.co/375133/hackers-use-bnb-chain-spread-malware-fake-captchas"},{"date":"2026-06-17","event":"Microsoft Security Blog publicly discloses the CryptoBandits malware: a clipboard hijacker polling every 500 milliseconds for cryptocurrency wallet addresses, propagating via USB worm, and routing C2 traffic through Tor. Trojan:Win32/CryptoBandits.A detection name assigned.","source":"Microsoft Security Blog","source_url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/"},{"date":"2026-08-07","event":"Microsoft Threat Intelligence publicly discloses the active ClickFix + EtherHiding + BNB Chain campaign, stating it targets thousands of enterprise and consumer Windows devices globally every day. Payloads identified include Lumma Stealer, XWorm, AsyncRAT, and MintsLoader. Detections Trojan:Win32/ClickFix.* and Trojan:Win32/TermFix.* named.","source":"crypto.news / Decrypt / Crypto Economy","source_url":"https://crypto.news/microsoft-flags-clickfix-malware-using-bnb-chain-to-fetch-attack-instructions/"},{"date":"2026-08-07","event":"Huntress researchers separately document a Go-based macOS infostealer delivered via ClickFix attacks, capable of partially redirecting cryptocurrency transactions without fully emptying wallets to evade detection.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html"},{"date":"2026-08-08","event":"The Hacker News reports over 250 ClickFix domains using browser fingerprinting to serve platform-specific macOS malware lures, indicating campaign infrastructure has scaled to hundreds of distinct lure domains.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser-fingerprinting-to-hide-macos-malware-lures.html"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6ea9269f-8b4a-4ecd-bf6c-a498935150b3copy