Báo cáo Tình báo Đe dọa của Microsoft phát hiện các cuộc tấn công phần mềm độc hại liên quan đến BNB Smart Chain, nhắm mục tiêu hàng ngàn thiết bị mỗi ngày

The Huoxing Finance report states that Microsoft Threat Intelligence posted on X that a cluster of compromised websites is using ClickFix and EtherHiding techniques to distribute malware, launching thousands of attacks daily against enterprise and consumer devices worldwide. Attackers inject Base64-encoded JavaScript to communicate with BNB Smart Chain RPC gateways, retrieving next-stage instructions stored in smart contracts; since only the contract deployer’s wallet can modify the contract content, traditional takedown methods are ineffective. The attack tricks users into opening a Run dialog box with fake CAPTCHAs, prompting them to paste clipboard content and execute attacker commands, while abusing multiple system tools such as conhost, cmd, PowerShell, and mshta, along with command obfuscation techniques. Successful execution may lead to credential exposure, persistence establishment, lateral movement, and even ransomware attacks. Microsoft recommends enterprises enable Defender’s multi-layered protection, restrict command-line tools, and enable PowerShell script logging, while reminding users never to paste untrusted commands into Run windows or terminals.