Microsoft warns ClickFix hackers are hiding malware code inside BNB Smart Chain contracts

Microsoft Threat Intelligence said [date] that hackers are hiding malware instructions inside BNB Smart Chain smart contracts, a technique it said is infecting thousands of enterprise and consumer devices every day.

According to Microsoft Threat Intelligence, attackers are abusing BNB Smart Chain smart contracts to host malicious instructions, allowing malware campaigns to continue operating even when traditional command-and-control infrastructure is disrupted. The company said the attacks are reaching thousands of enterprise and consumer devices every day, highlighting how blockchain is increasingly being weaponized by threat actors.

The campaign combines social engineering with decentralized infrastructure, making it significantly more difficult for security teams to shut down malicious operations once they are active.

“Threat actors continue to innovate by combining trusted technologies with social engineering to increase the resilience of their campaigns,” Microsoft Threat Intelligence noted in its latest report.

ClickFix malware campaign hides attack instructions on BNB Chain

Microsoft said the ClickFix malware campaign begins with attackers compromising legitimate websites before injecting Base64-encoded JavaScript into their pages. Rather than retrieving malicious payloads from conventional servers, the script communicates directly with a BNB Smart Chain Remote Procedure Call (RPC) gateway.

The JavaScript queries a smart contract previously associated with the ClearFake malware campaign, allowing attackers to retrieve instructions stored on the blockchain instead of centralized infrastructure.

This tactic presents a significant challenge for defenders.

Unlike traditional malware servers that can often be seized or taken offline, smart contract data can only be modified by the owner of the wallet that deployed the contract. As a result, security teams cannot easily remove or redirect the malicious instructions through common takedown or sinkholing techniques.

Microsoft said this decentralized approach gives attackers a more resilient delivery mechanism while making detection and disruption considerably harder.

The findings demonstrate how blockchain technology, originally designed to provide transparency and immutability, can also be exploited by cybercriminals seeking to increase the durability of their infrastructure.

Fake CAPTCHA pages trick victims into infecting their own computers

At the center of the ClickFix malware operation is an increasingly convincing social engineering technique.

Victims are presented with what appears to be a legitimate CAPTCHA verification page asking them to prove they are human. Instead of completing a standard verification process, users are instructed to press Windows + R, paste preloaded clipboard content into the Run dialog, and execute the command.

By following the instructions themselves, victims unknowingly launch attacker-controlled code on their own systems.

Microsoft researchers said attackers heavily obfuscate these commands to avoid detection. The campaigns abuse legitimate Windows utilities including PowerShell, cmd.exe, conhost, rundll32, mshta, msiexec, curl, WMI, WebDAV, pcalua, and scheduled tasks.

The report also identified multiple evasion techniques designed to make malicious commands appear harmless. These include splitting keywords with caret characters, hiding interpreters inside environment variables, and launching Windows processes in minimized or headless mode to reduce visibility.

Microsoft also observed threat actors deploying a related technique known as TerminalFix.

Instead of directing victims to the Windows Run dialog, TerminalFix instructs users to paste malicious commands into Windows Terminal or PowerShell. While the delivery method differs slightly, both techniques rely on convincing users to execute malware voluntarily.

The company described both ClickFix and TerminalFix as high-volume initial access techniques capable of compromising thousands of systems globally each day.

Successful infections can lead to credential theft and ransomware

Microsoft warned that ClickFix malware is not a standalone threat but rather an entry point for a much broader range of cyberattacks.

After gaining initial access, attackers deploy multiple malware families, including Lumma Stealer, Xworm, AsyncRAT, MintsLoader, remote management tools, and other information-stealing payloads.

These tools can harvest usernames, passwords, authentication cookies, browser data, and cryptocurrency wallet information before establishing persistence inside compromised networks.

Researchers warned that a single successful execution may also enable lateral movement across enterprise environments, allowing attackers to escalate privileges and ultimately deploy human-operated ransomware.

“Organizations should treat detections associated with ClickFix activity as potential indicators of an initial access incident,” Microsoft advised, recommending immediate isolation of affected devices and investigations into credential compromise and persistence mechanisms.

The warning aligns with guidance from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which has consistently emphasized that phishing and social engineering remain among the most effective initial access techniques used by cybercriminals.

To reduce exposure, Microsoft recommends enabling Microsoft Defender network, web, and cloud-delivered protection, restricting unnecessary access to Windows Run and command-line tools, enabling PowerShell script-block logging, and enforcing application control policies.

Most importantly, the company urged users never to paste commands from CAPTCHA pages, browser error messages, advertisements, unsolicited technical support pages, or emails into Windows Run, Terminal, Command Prompt, or PowerShell.

Microsoft expands defenses as blockchain-powered attacks evolve

Microsoft said Microsoft Defender XDR now provides layered protection against ClickFix malware throughout the attack chain.

The platform can block malicious websites and phishing pages using Defender SmartScreen and Defender for Office 365 while also detecting suspicious command execution and outbound communications. Alerts such as “Possible ClickFix activity,” “Possible initial access from an emerging threat,” and “Suspicious command in RunMRU registry” help defenders identify early indicators of compromise.

Microsoft Defender Antivirus also detects malicious activity using signatures including Trojan:Win32/ClickFix.* and Trojan:Win32/TermFix.*.

The latest warning follows another Microsoft Threat Intelligence report published in June detailing the CryptoBandits clipper campaign, which monitored users’ clipboards for cryptocurrency wallet addresses, seed phrases, and private keys before replacing copied wallet addresses with attacker-controlled alternatives.

Researchers found that campaign also employed Tor communications, scheduled tasks for persistence, screenshot capture, and remote code execution, effectively functioning as a lightweight backdoor.

Microsoft has likewise warned about other crypto-focused threats this year, including StilachiRAT, which targets browser-based cryptocurrency wallets, and SparkCat, malware capable of scanning screenshots for wallet seed phrases. Separately, Binance has cautioned users about clipboard hijacking malware that silently replaces copied cryptocurrency wallet addresses during transactions.

Security experts say the evolution of ClickFix malware demonstrates how threat actors are increasingly blending decentralized technologies with sophisticated social engineering, creating campaigns that are both technically resilient and psychologically effective. As attackers continue to innovate, organizations will need stronger endpoint protection, user awareness training, and proactive threat monitoring to stay ahead of rapidly evolving cyber threats.