Overview
- Microsoft Threat Intelligence said Friday that a cluster of compromised websites is showing fake CAPTCHA or terminal prompts that instruct users to paste and run attacker-supplied commands.
- The malicious JavaScript on those sites queries BNB Smart Chain smart contracts to fetch Base64-encoded instructions, a technique Microsoft calls EtherHiding.
- Because only the wallet controlling a contract can change its contents, defenders cannot remove on-chain instructions with standard server takedowns or sinkholing.
- After victims run the commands, attackers weaponize built-in Windows tools such as PowerShell, cmd, mshta, rundll32, curl, WMI, and scheduled tasks to install infostealers, RATs, and loaders.
- Microsoft advised organizations to enable Defender protections, restrict Run/Terminal/PowerShell access, enable PowerShell script-block logging, enforce application control, and teach users never to paste commands from CAPTCHAs or unsolicited pages.