ClearFake Uses BNB Smart Chain Testnet Contracts to Deliver SectopRAT and ACRStealer
Summary
Trend Micro analyzed a ClearFake campaign that used BNB Smart Chain testnet contracts to route ClickFix lures to Windows and macOS victims, delivering SectopRAT and ACRStealer and tracking successful executions on-chain.
Key points
- Injected JavaScript on a compromised website queried BNB Smart Chain testnet contracts to retrieve payloads, avoiding conventional URL-based blocking.
- Four contracts handled payload storage, Windows and macOS routing, and tracking successful victim executions; they shared one deployer wallet and remained active during the analysis.
- Anti-analysis checks screened for headless browsers and private or localhost IPs before routing victims to OS-specific ClickFix lures.
- The lures imitated Google reCAPTCHA and copied commands to victims’ clipboards, prompting them to run the commands manually.
- The Windows infection chain deployed SectopRAT and ACRStealer, targeting browser credentials, sessions, and other sensitive data; the macOS lure used a shell command to download and run a script.
- Trend Micro recommends blocking the identified testnet RPC endpoint, restricting clipboard access, disabling WebClient where unnecessary, and monitoring for JSON-RPC and related execution patterns.
Article Details
- Attack Vectors
- ClearFake JavaScript was injected into a compromised WordPress recreational website and queried BNB Smart Chain testnet contracts to retrieve staged payloads.
- The campaign used a ClickFix fake CAPTCHA overlay to trick victims into executing clipboard-injected commands on Windows or macOS.
- On Windows, the WebClient service loaded a remote DLL into memory; the resulting process injected remote threads into Chrome and Edge.
- On macOS, the clipboard command used curl to download and execute a remote shell script; the download URL was not recoverable from static analysis.
- The delivered payloads included SectopRAT and ACRStealer, with DLL sideloading also used to execute ACRStealer.
- Defensive Notes
- Block outbound JSON-RPC traffic to the BNB Smart Chain testnet RPC endpoint identified in the article.
- Disable the Windows WebClient service on workstations that do not require WebDAV; where it cannot be disabled, detect rundll32.exe activity with UNC path arguments.
- Restrict browser clipboard write access and train users to recognize fake CAPTCHA and ClickFix lures.
- Monitor web proxy logs for eth_call and JSON-RPC patterns associated with EtherHiding.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bsc-testnet-rpc[.]publicnode[.]com | BNB Smart Chain testnet RPC endpoint queried by the injected ClearFake JavaScript to retrieve contract payloads. |
| DOMAIN | download2324[.]mediafire[.]com | MediaFire host queried during the infection; the article reports a MediaFire fallback for stolen data, but does not confirm the specific content of this observed query. |
| DOMAIN | ip-info[.]ff[.]avast[.]com | Avast geolocation API contacted by the ClickFix payload to obtain victims' public IP addresses for tracking. |
MITRE ATT&CK
T1055 · Process InjectionTelemetry recorded rundll32.exe injecting remote threads into chrome.exe and msedge.exe.T1056.003 · Web Portal CaptureSectopRAT hijacked browser sessions in Chrome or Edge running on an invisible secondary desktop.T1059.006 · PythonThe Windows infection deployed a Python runtime and launched pythonw.exe with helper.py.T1059.007 · JavaScriptThe macOS ClickFix clipboard command used Bash to download and execute a remote shell script.T1115 · Clipboard DataThe ClickFix overlay wrote a command to the victim's clipboard for manual execution.T1189 · Drive-by CompromiseClearFake JavaScript was injected into a compromised website that victims visited.T1574.002 · DLL Side-LoadingA malicious libvlccore.dll was staged beside legitimate VLC components and used to execute ACRStealer.
People
Threat Actors
Malware
ACRStealerThe attack chain ended with two simultaneously deployed stealers, SectopRAT and ACRStealer alongside an on-chain execution tracker that confirmed each victim compromise in real time.ClearFakeSmart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC TestnetSectopRATThe attack chain ended with two simultaneously deployed stealers, SectopRAT and ACRStealer alongside an on-chain execution tracker that confirmed each victim compromise in real time.
Vendors
AvastThis check does not see the endpoint's internal network IP but the public egress IP returned by Avast IP geolocation service.GoogleGoogle's October 2025 research confirmed that North Korean state-sponsored actors (UNC5342) have since adopted the same technique, indicating that blockchain C&C has now been adopted by nation-state capability.Trend MicroVega Security The Python-based payload matches the ACRStealer profile as independently identified by Vega Security in their analysis of a similar ClearFake contract cluster published February 2026.
Products
BNB Smart ChainTrendAI™ Research analyzed an intrusion where threat actors used the EtherHiding technique to route ClearFake payload delivery through smart contracts on the BNB Smart Chain testnet.EdgeIt spawned an invisible secondary desktop to silently hijack browser sessions in Chrome or Edge that ran in the background, fully controlled by the attacker, while the victim saw nothing.FileZillaA complete Python 3.15 embeddable runtime was then deployed to C:\Users\[User]\AppData\Local\FileZilla\Data\DC80D99D\, a directory chosen to blend with the legitimate FileZilla FTP client.Google Chrome!window.chrome && !window.safari && !navigator.userAgent.includes("Firefox"): Checks if none of Chrome, Safari, or Firefox are detected in the browser environment Mozilla Firefox!window.chrome && !window.safari && !navigator.userAgent.includes("Firefox"): Checks if none of Chrome, Safari, or Firefox are detected in the browser environment TrendAI Vision OneThis analysis began as a TrendAI Vision One™ Managed Detection Response (MDR) case, where a customer organization had one employee browsing a legitimate recreational website and then ended up with a multi-stageWordPressThe victim browsed a legitimate Swiss recreational activity site running on WordPress where 22 scripts loaded by the page were legitimate WordPress and plugin resources, but one was not.Yandex Metrikacontains one capability absent from the Windows version: on successful overlay display, it injects a Yandex Metrika analytics tracker (counter ID 99162160, that loads mc.yandex[.]ru/metrika/tag.js) via a nested