Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet

MITRE Techniques

• [T1059.007 ] JavaScript – Used as the initial injected loader and blockchain query mechanism in the compromised website (‘an injected JavaScript loader into compromised websites’ and ‘the injected JavaScript on compromised websites queried these contracts’).
• [T1027 ] Obfuscated Files or Information – The Stage 1 script used string-array rotation and runtime shuffling to hide its logic (‘The obfuscation uses a standard anti-static-analysis technique’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The script checked for headless browsers, automation frameworks, and zero-sized windows to avoid analysis (‘navigator.webdriver === true’, ‘HeadlessChrome’, ‘Puppeteer’, ‘Playwright’).
• [T1036 ] Masquerading – The malware used a fake Google reCAPTCHA/ClickFix overlay and blended FileZilla-like paths to appear legitimate (‘a convincing Google reCAPTCHA lookalike’ and ‘chosen to blend with the legitimate FileZilla FTP client’).
• [T1105 ] Ingress Tool Transfer – Payloads and scripts were fetched from smart contracts and remote URLs (‘retrieve and route victims to the next stage’ and ‘downloads and executes a remote shell script via curl’).
• [T1115 ] Clipboard Data – The overlay injected commands into the victim clipboard via navigator.clipboard.writeText() (‘to inject the command into the victim’s clipboard’).
• [T1204.002 ] User Execution: Malicious File – The victim had to interact with the fake verification flow and execute a clipboard-sourced command (‘press Enter on your keyboard to finish’ and ‘the victim opened the Run dialog and executed the clipboard command’).
• [T1055 ] Process Injection – rundll32.exe injected remote threads into browser processes for credential theft (‘injecting remote threads into chrome.exe and msedge.exe’).
• [T1218.011 ] Signed Binary Proxy Execution: Rundll32 – rundll32.exe was used to host the payload and drive browser injection (‘rundll32.exe process (hosting the put34b.camp payload)’).
• [T1071.001 ] Web Protocols – The campaign used JSON-RPC/eth_call over HTTP(S) to query blockchain contracts (‘eth_call’, ‘a JSON-RPC method’, ‘constructs an eth_call JSON-RPC request’).