Microsoft Threat Intelligence reports BNB Smart Chain-linked malware attacks targeting thousands of devices daily.

Huo Xing Cai Jing reports that Microsoft Threat Intelligence posted on X that a cluster of compromised websites is using ClickFix and EtherHiding techniques to distribute malware, launching thousands of attacks daily against enterprise and consumer devices worldwide. Attackers inject Base64-encoded JavaScript to communicate with BNB Smart Chain RPC gateways, retrieving next-stage instructions stored in smart contracts; since only the contract deployer’s wallet can modify the contract content, traditional takedown methods are ineffective. The attack tricks users into opening a Run dialog with fake CAPTCHAs, prompting them to paste clipboard content and execute attacker commands, while abusing multiple system tools—including conhost, cmd, PowerShell, and mshta—and employing command obfuscation techniques. Successful execution may lead to credential exposure, persistence establishment, lateral movement, and even ransomware attacks. Microsoft recommends enterprises enable Defender’s multi-layered protection, restrict command-line tool usage, and enable PowerShell script logging, while advising users never to paste untrusted commands into Run windows or terminals.