Microsoft ClickFix attack campaign leverages BNB Smart Chain to host malicious commands, targeting thousands of devices daily

Microsoft Threat Intelligence posted on the X platform that a cluster of compromised websites has been found using ClickFix and EtherHiding technologies to spread malware, with attacks targeting thousands of enterprise and consumer devices worldwide every day.

Attackers inject Base64 encoded JavaScript to connect to the BNB Smart Chain RPC gateway, obtaining the next stage instructions stored by smart contracts. Since the contract content can only be modified by the deployer's wallet, traditional takedown methods are difficult to counter. The attack deceives users into opening a run dialog box with fake verification codes, pasting clipboard content, and executing commands from the attacker, while also involving the abuse of various system tools such as conhost, cmd, PowerShell, and mshta, as well as command obfuscation techniques. Successful execution may lead to credential exposure, persistence establishment, lateral movement, and even ransomware attacks.

Microsoft recommends that enterprises enable Defender's multi-layer protection, restrict command line tools, enable PowerShell script logging, and remind users not to paste commands from unknown sources into the run window or terminal for execution.