“Tal said hosting malicious files on the Binance Smart Chain is ideal for attackers because retrieving the malicious contract is a cost-free operation that was originally designed for the purpose of debugging contract execution issues without any real-world impact.”
ClearFake plants fake browser update prompts on hacked WordPress sites. When Cloudflare blocked its accounts, the crew moved the payload into smart contracts on the Binance Smart Chain. Reading it costs nothing and leaves no trace. “Unchangeable” and “no takedown” were the blockchain’s selling points, and malware authors read the brochure.