Microsoft: Discovers new attack campaign hiding malicious code via BNB Chain smart contracts, affecting thousands of devices globally.

Microsoft’s Threat Intelligence Team has released a report disclosing a set of compromised websites that use ClickFix and TerminalFix to launch social engineering attacks, combined with EtherHiding technology, to access smart contracts via the BNB Smart Chain RPC gateway for retrieving subsequent malicious commands. Since the malicious content is stored in on-chain smart contracts, only the wallet owner that deployed the contract can modify it, making it hard to eliminate through traditional takedown or blocking measures. Attackers forge CAPTCHA verification pages to trick users into opening Windows’ Run window, Terminal, or PowerShell, then pasting and executing malicious commands. The attack workflow extensively leverages system tools including conhost, PowerShell, mshta, rundll32, curl, WMI, and WebDAV for obfuscation and Living-off-the-Land (LotL) attacks. Microsoft points out that ClickFix and TerminalFix have emerged as high-frequency initial intrusion vectors, impacting thousands of enterprise and personal devices worldwide daily. Multiple threat actors use these tactics to spread malware such as Lumma Stealer, Xworm, AsyncRAT, and MintsLoader, which can further lead to credential theft, lateral movement, and ransomware attacks. The tech giant advises users against following prompts from CAPTCHAs, web error pages, emails, or ads to paste and execute any commands in Windows Run, Terminal, PowerShell, or Command Prompt.