Microsoft Discovers New Attack Using BNB Chain Smart Contracts to Hide Malware

According to ME News, on August 7 (UTC+8), Microsoft’s Threat Intelligence Team reported that a batch of compromised websites have been leveraging ClickFix and TerminalFix to initiate attacks, combined with EtherHiding techniques to access smart contracts via BNB Smart Chain RPC gateways and retrieve subsequent malicious commands. Since the malicious content is stored on-chain within smart contracts, only the wallet owner who deployed the contract can modify it, making removal through traditional takedown or blocking methods extremely difficult. Microsoft noted that attackers forge CAPTCHA verification pages to trick users into opening the Windows “Run” dialog, Terminal, or PowerShell, where they are prompted to paste and execute malicious commands. The attack extensively employs system tools such as conhost, PowerShell, mshta, rundll32, curl, WMI, and WebDAV for obfuscation and “Living-off-the-Land” tactics. Microsoft stated that ClickFix and TerminalFix have become prevalent initial infection vectors, affecting thousands of enterprise and personal devices globally each day. Multiple threat groups are using them to distribute malware including Lumma Stealer, Xworm, AsyncRAT, and MintsLoader, potentially leading to credential theft, lateral movement, and ransomware attacks. Microsoft advises users never to paste or execute any commands in the Windows “Run” dialog, Terminal, PowerShell, or Command Prompt based on prompts from CAPTCHA, website errors, emails, or advertisements. (Source: BlockBeats)