Microsoft Discovers ClickFix Attacks Leveraging BNB Smart Chain to Target Thousands of Devices Daily

ChainCatcher reports that Microsoft Threat Intelligence posted on X that a cluster of compromised websites is using ClickFix and EtherHiding techniques to distribute malware, launching thousands of attacks daily against enterprise and consumer devices worldwide. Attackers inject Base64-encoded JavaScript to communicate with BNB Smart Chain RPC gateways, retrieving next-stage instructions stored in smart contracts; since only the contract deployer’s wallet can modify the contract content, traditional takedown methods are ineffective. The attack tricks users into opening a Run dialog with fake CAPTCHAs, prompting them to paste clipboard content and execute attacker commands, while abusing system tools such as conhost, cmd, PowerShell, and mshta, along with command obfuscation techniques. Successful execution may lead to credential exposure, persistence establishment, lateral movement, and even ransomware attacks. Microsoft recommends enterprises enable Defender’s layered defense, restrict command-line tools, and enable PowerShell script logging, and advises users never to paste untrusted commands into Run windows or terminals.