Executive Summary
TrendAI Research has identified an advanced campaign by the suspected North Korean threat group UNC5342 (ClearFake) utilizing the 'EtherHiding' technique. This method stores malicious JavaScript and payload routing instructions directly within smart contracts on the BNB Smart Chain (BSC) testnet. By leveraging blockchain infrastructure, the attackers create a decentralized and immutable command-and-control layer that is resistant to traditional takedown efforts, sinkholing, or domain blocking.
The attack employs 'ClickFix' social engineering lures, presenting victims with fake Google reCAPTCHA overlays. Once a user follows the instructions, the chain deploys SectopRAT and ACRStealer. The campaign is highly sophisticated, featuring automated OS-based routing, anti-sandbox environment checks (is_Headless), and a unique on-chain execution tracker that uses a specific smart contract to log successful compromises and prevent re-infection of the same victim.
This evolution represents a significant shift from proof-of-concept blockchain abuse to a persistent, cost-effective operational threat. Because the infrastructure resides on a public testnet, it is free for attackers to maintain while remaining globally accessible and nearly impossible for law enforcement to purge.