Skip to main content
AVOID.NET
← ClickFix BNB Chain EtherHiding Malware Campaignreviewed 2026-10-16 · 20 claims checked

Fact-check findings

What an automated fact-checker found when it re-read ClickFix BNB Chain EtherHiding Malware Campaign against the sources the page cites. Only the most recent review is shown.

Read this first

These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.

“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.

Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.

disputed 6unverifiable 1link rot 4partially supported 1confirmed 810 corrections pending · 0 applied

disputed

6 claims

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

  1. #1[disputed][awaiting moderator]in the summary
    “An active malware campaign, publicly disclosed by Microsoft Threat Intelligence on August 7, 2026, combines ClickFix-style fake CAPTCHA social engineering with the EtherHiding technique to store malicious payload instructions inside BNB Smart Chain smart contracts.”
    reviewerMicrosoft Threat Intelligence publicly disclosed the ClickFix/EtherHiding/BNB Chain campaign on August 7, 2026.The page conflates the date secondary outlets published their stories (Aug 7) with the date Microsoft itself disclosed the campaign (Aug 6, per the embedded Microsoft X post cited by two independent outlets). The disclosure date itself is off by one day.
    Proposed correction (not yet applied)
    An active malware campaign, publicly disclosed by Microsoft Threat Intelligence on August 6, 2026, combines ClickFix-style fake CAPTCHA social engineering with the EtherHiding technique to store malicious payload instructions inside BNB Smart Chain smart contracts.
    citedcrypto.news/microsoft-flags-clickfix-mal…ck-instructions/decrypt.co/375133/hackers-use-bnb-chain-…re-fake-captchas
  2. #2[disputed][awaiting moderator]in section: Campaign Overview
    “Microsoft Threat Intelligence publicly disclosed the campaign on August 7, 2026, identifying a cluster of compromised websites displaying ClickFix lures and using EtherHiding — a technique first associated with the ClearFake campaign in September 2023.”
    reviewerMicrosoft Threat Intelligence publicly disclosed the campaign on August 7, 2026 (restated in Campaign Overview section).Same defect as the summary: the disclosure date should read August 6, 2026. The 'September 2023' EtherHiding/ClearFake attribution in this same sentence is independently confirmed by Google's GTIG blog and is not disputed.
    Proposed correction (not yet applied)
    Microsoft Threat Intelligence publicly disclosed the campaign on August 6, 2026, identifying a cluster of compromised websites displaying ClickFix lures and using EtherHiding — a technique first associated with the ClearFake campaign in September 2023.
    citedcrypto.news/microsoft-flags-clickfix-mal…ck-instructions/crypto-economy.com/microsoft-warns-hacke…tribute-malware/
  3. #3[disputed][awaiting moderator]in the timeline
    “2026-08-07”
    reviewerMicrosoft Threat Intelligence publicly discloses the campaign on 2026-08-07 (timeline entry).Timeline date field should reflect Microsoft's actual disclosure date (Aug 6), not the date secondary press coverage appeared (Aug 7).
    Proposed correction (not yet applied)
    2026-08-06
    citedcrypto.news/microsoft-flags-clickfix-mal…ck-instructions/
  4. #4[disputed][awaiting moderator]in section: EtherHiding: On-Chain Payload Delivery
    “Microsoft notes that 'only the owner of the cryptocurrency wallet that deployed the contract can modify its contents.'”
    reviewerMicrosoft is directly quoted as saying 'only the owner of the cryptocurrency wallet that deployed the contract can modify its contents.'The underlying fact (only the deployer's wallet can modify contract contents) is accurate and widely reported, but none of the three independently fetched sources render this as a verbatim quotation from Microsoft; the quotation marks and 'Microsoft notes' attribution appear to be fabricated.
    Proposed correction (not yet applied)
    Security researchers note that only the owner of the cryptocurrency wallet that deployed the contract can modify its contents.
    citedcrypto-economy.com/microsoft-warns-hacke…tribute-malware/
  5. #7[disputed][awaiting moderator]in the timeline
    “2023-08”
    reviewerEtherHiding was first associated with the ClearFake campaign beginning in August 2023 (timeline places the start of ClearFake's EtherHiding use at 2023-08).The page's own tier-1 source (Google Cloud/GTIG) gives September 2023 as the month EtherHiding emerged in ClearFake, which conflicts with the timeline's August 2023 date. The 2023 Hacker News piece is ambiguous (implies 'about two months' before an Oct 16 publish date) and does not clearly resolve the conflict, but the more authoritative retrospective source says September.
    Proposed correction (not yet applied)
    2023-09
    citedthehackernews.com/2023/10/binances-smart…ited-in-new.htmlcloud.google.com/blog/topics/threat-inte…opts-etherhiding
  6. #13[disputed][awaiting moderator]in the timeline
    “2026-08-08”
    reviewerMore than 250 ClickFix domains using browser fingerprinting to serve macOS-targeted malware lures were documented by The Hacker News in August 2026, reported on 2026-08-08.The actual Hacker News article confirming '250+ ClickFix domains' is dated August 5, 2026, three days earlier than the timeline entry.
    Proposed correction (not yet applied)
    2026-08-05
    citedthehackernews.com/2026/08/over-250-click…lware-lures.html

unverifiable

1 claim

No source the reviewer could reach confirms or contradicts the claim.

  1. #6[unverifiable][awaiting moderator]in section: Why Traditional Takedowns Are Ineffective
    “Microsoft noted that the architecture makes the instructions 'difficult to remove using conventional takedown or sinkholing methods.'”
    reviewerMicrosoft noted the architecture makes the instructions 'difficult to remove using conventional takedown or sinkholing methods.'Plausible and consistent with multiple outlets' description of the problem, but I could not independently confirm this exact phrase against Microsoft's primary source.
    citedcrypto.news/microsoft-flags-clickfix-mal…ck-instructions/cloud.google.com/blog/topics/threat-inte…opts-etherhiding

partially supported

1 claim

The cited evidence supports part of the claim but not all of it.

  1. #20[partially supported][awaiting moderator]in section: EtherHiding: On-Chain Payload Delivery
    “The technique was first documented at scale in the ClearFake campaign beginning in August–September 2023, when it was described by researchers as 'the next level of bulletproof hosting.'”
    reviewerEtherHiding was first documented at scale in the ClearFake campaign and described by researchers as 'the next level of bulletproof hosting.'The quote and ClearFake attribution are confirmed; the hedged two-month range here is more defensible than the unhedged single month used in the timeline entry (timeline[0]), which is flagged separately.
    citedthehackernews.com/2023/10/binances-smart…ited-in-new.html

confirmed

8 claims

The cited evidence supports the claim as written.

  1. #5[confirmed][no action needed]in section: Scope and Scale
    “Microsoft Threat Intelligence stated that campaigns using this infrastructure are 'targeting thousands of enterprise and consumer devices globally every day.'”
    reviewerMicrosoft Threat Intelligence stated campaigns using this infrastructure are 'targeting thousands of enterprise and consumer devices globally every day.'Quote closely matches reporting; verified via Decrypt's coverage.
    citeddecrypt.co/375133/hackers-use-bnb-chain-…re-fake-captchas
  2. #8[confirmed][no action needed]in section: Deployed Malware Families
    “A separate but related April 2026 campaign variant used the credential stealer Omnistealer, which leveraged TRON, Aptos, and BNB Chain for payload delivery to steal passwords, cloud account data, and crypto wallet contents.”
    reviewerA separate but related April 2026 campaign variant used the credential stealer Omnistealer, which leveraged TRON, Aptos, and BNB Chain for payload delivery.Independently corroborated by Malwarebytes reporting from April 2026.
    citeddecrypt.co/375133/hackers-use-bnb-chain-…re-fake-captchas
  3. #9[confirmed][no action needed]in section: Deployed Malware Families
    “The macOS-targeting ClickFix variant, documented by Huntress in August 2026, deployed a Go-based infostealer capable of intercepting and partially redirecting cryptocurrency transactions without fully emptying wallets, making detection more difficult.”
    reviewerThe macOS-targeting ClickFix variant, documented by Huntress in August 2026, deployed a Go-based infostealer capable of intercepting and partially redirecting cryptocurrency transactions without fully emptying wallets.Fully corroborated.
    citedthehackernews.com/2026/08/clickfix-attac…cos-stealer.html
  4. #10[confirmed][no action needed]in section: Deployed Malware Families
    “Microsoft identified five categories of payloads deployed post-execution in the August 2026 campaign disclosure: (1) Lumma Stealer — an information stealer targeting browser credentials, cookies, cryptocurrency wallet files, and two-factor authentication data; (2) XWorm — a remote access trojan providing persistent backdoor access; (3) AsyncRAT — a .NET-based remote access trojan used for surveillance, keylogging, and lateral movement; (4) MintsLoader — a lightweight loader used to fetch and execute additional second-stage payloads; and (5) unspecified remote management tools.”
    reviewerMicrosoft identified five categories of payloads: Lumma Stealer, XWorm, AsyncRAT, MintsLoader, and unspecified remote management tools.Matches the primary cited reporting; the per-payload descriptions are standard and consistent with public threat intel.
    citeden.coinotag.com/bnb-chain-malware-warnin…-5-payload-typescrypto.news/microsoft-flags-clickfix-mal…ck-instructions/
  5. #11[confirmed][no action needed]in section: EtherHiding: On-Chain Payload Delivery
    “In October 2025, Google Threat Intelligence Group (GTIG) separately reported that the DPRK-linked threat actor UNC5342 had adopted EtherHiding for nation-state operations, marking the first documented state-sponsored use of the technique.”
    reviewerIn October 2025, Google Threat Intelligence Group (GTIG) reported that DPRK-linked threat actor UNC5342 had adopted EtherHiding, marking the first documented state-sponsored use of the technique.Directly confirmed against the primary Google Cloud blog post.
    citedcloud.google.com/blog/topics/threat-inte…opts-etherhiding
  6. #12[confirmed][no action needed]in section: CryptoBandits: Crypto Clipboard Hijacker
    “CryptoBandits (detected as Trojan:Win32/CryptoBandits.A) is a clipboard-hijacking and worm-propagation malware family separately disclosed by Microsoft on June 17, 2026 and noted in connection with payload delivery in this campaign cluster.”
    reviewerCryptoBandits was separately disclosed by Microsoft on June 17, 2026, polls the clipboard approximately every 500 milliseconds, and the campaign has been active since at least February 2026.Fully confirmed against the primary Microsoft Security Blog post.
    citedwww.microsoft.com/en-us/security/blog/20…istence-control/
  7. #18[confirmed][no action needed]in section: Deployed Malware Families
    “Earlier campaign variants delivered GULoader, a shellcode-based in-memory loader commonly used to drop infostealers including RedLine and Vidar, and RATs such as Remcos and AgentTesla.”
    reviewerEarlier campaign variants delivered GULoader, used to drop RedLine, Vidar, Remcos, and AgentTesla.Consistent with established, widely corroborated reporting on GULoader's typical payload set.
    citedcybersecuritynews.com/clickfix-campaign-…ng-and-guloader/blog.sicuranext.com/one-paste-to-rule-th…oader-intrusion/
  8. #19[confirmed][no action needed]in section: Attack Chain and Technical Execution
    “A documented intrusion traced the full execution chain as follows. (1) A legitimate European small-business WordPress site was infected with the ErrTraffic v3 backdoor, deployed inside the WordPress mu-plugins directory with self-healing capabilities and a hidden admin account.”
    reviewerA documented intrusion used the ErrTraffic v3 WordPress backdoor, BNB Smart Chain Testnet RPC endpoints, and IoCs including a specific SHA-256 hash and a .google-spoofed DLL path.Directly corroborated by the Sicuranext research post, including the specific technical IoCs repeated in the separate 'Indicators of Compromise' section.
    citedblog.sicuranext.com/one-paste-to-rule-th…oader-intrusion/
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.