Microsoft: Hackers Are Using BNB Chain to Launch ClickFix Malware Attacks

TLDR

• Microsoft has identified a malware campaign using BNB Smart Chain to hide and distribute malicious code
• Hackers inject JavaScript into legitimate websites, linking to smart contracts that store attack instructions
• Victims are tricked into running commands via fake CAPTCHA pages using a method called ClickFix
• Once infected, devices can have passwords, browser data, and crypto wallet info stolen
• Microsoft warns users to never paste commands from CAPTCHA pages, pop-ups, or emails

---

Microsoft Threat Intelligence has identified a cyberattack campaign that uses the BNB Smart Chain to store and deliver malicious code. Hackers compromise legitimate websites and inject JavaScript that connects to a smart contract on the blockchain.

Microsoft: Attackers Use BNB Smart Chain Contracts to Deliver Malware Instructions

Microsoft Threat Intelligence identified compromised websites using the EtherHiding technique to retrieve malicious instructions from a smart contract via a BNB Smart Chain RPC gateway. The… pic.twitter.com/IjUIjPmmsH

— Wu Blockchain (@WuBlockchain) August 8, 2026

Because only the wallet owner can alter or delete a smart contract, security teams cannot take the malicious infrastructure offline the way they could with a traditional server. This makes the attack much harder to stop.

The technique being used is called EtherHiding. It was previously linked to the ClearFake malware campaign, which has been infecting websites since late 2023.

When a user visits a compromised site, they are shown a fake CAPTCHA page. Instead of a standard verification challenge, the page tells them to open the Windows Run dialog, paste a command from their clipboard, and press Enter.

This method, known as ClickFix, relies on the victim running the malware themselves. A variation called TerminalFix directs users to Windows Terminal or PowerShell instead.

What Happens After Infection

Microsoft says the attackers use legitimate Windows tools to avoid detection. These include PowerShell, Command Prompt, mshta, rundll32, curl, and Windows Management Instrumentation.

Once a device is infected, several malware programs can be installed. These include Lumma Stealer, XWorm, AsyncRAT, and MintsLoader.

These tools can steal passwords, browser data, and cryptocurrency wallet information. They can also give attackers lasting access to a device or network.

Microsoft warns that infected machines could eventually become targets for ransomware attacks. In those cases, attackers take manual control of a network before encrypting files.

The use of blockchain to support malware is not new. In 2016, Cerber ransomware used Bitcoin transactions to find command-and-control servers. The Glupteba botnet used Bitcoin from 2019 to 2021. In April 2026, researchers found Omnistealer using TRON, Aptos, and BNB Chain to steal credentials and crypto wallet data.

This is also not Microsoft’s first crypto-related security warning this year. In June, the company flagged a clipboard hijacking campaign that swapped copied wallet addresses with attacker-controlled ones. A month earlier, Microsoft reported a cryptojacking campaign using SEO poisoning.

BNB Chain itself has not been compromised. Attackers are abusing its decentralized structure to host instructions that cannot easily be removed.

What You Should Do

Microsoft advises users to never paste commands from CAPTCHA pages, browser pop-ups, emails, or unknown websites. Legitimate CAPTCHA systems do not ask users to run commands.

For businesses, Microsoft recommends enabling PowerShell logging, using application controls, and restricting unnecessary command-line tools.