Microsoft Warns ClickFix Uses BNB Chain to Deliver Malware
Attackers store immutable instructions in BNB smart contracts that resist takedowns, enabling fake CAPTCHA prompts that trick victims into pasting and running commands that install credential stealers and remote-access tools.
Overview
- Microsoft published a warning Friday that a campaign named ClickFix uses BNB Smart Chain contracts as a place to store attacker instructions queried by injected JavaScript on compromised websites.
- The attack works by injecting Base64-encoded JavaScript that queries a BNB RPC gateway and a smart contract, then displays a fake CAPTCHA that tells users to paste clipboard content into Windows Run, Terminal, or PowerShell to execute commands.
- Microsoft says these lures are high-volume and target thousands of enterprise and consumer devices each day and that successful execution can steal credentials, establish persistence, and open paths to lateral movement and ransomware.
- Researchers observed operators abusing built-in Windows tools such as cmd, PowerShell, mshta, rundll32, curl, WMI, and scheduled tasks and using obfuscation methods like caret splitting and environment-variable hiding; a TerminalFix variant targets Terminal/PowerShell directly.
- Microsoft recommends layered defenses including Microsoft Defender XDR and SmartScreen, restricting access to Run and command‑line tools, enabling PowerShell script-block logging, enforcing application control, and training users not to paste commands from web prompts.