Microsoft: Discovery of New Attack Campaign Exploiting BNB Chain Smart Contract to Conceal Malicious Code, Affecting Thousands of Devices Worldwide

BlockBeats News, August 7th - The Microsoft Threat Intelligence Team announced that a batch of compromised websites has been discovered conducting ClickFix and TerminalFix redirection attacks. These attacks, combined with EtherHiding technology, utilize the BNB Smart Chain RPC gateway to interact with smart contracts and retrieve the next stage of malicious instructions. As the malicious content is stored on-chain within a smart contract, only the wallet owner who deployed the contract can modify it, making it challenging to remove through traditional takedown or banning methods.

Microsoft pointed out that attackers are spoofing CAPTCHA verification pages to trick users into opening the Windows "Run" window or Terminal/PowerShell, where they are instructed to paste and execute malicious commands. Throughout the attack process, a wide range of system tools such as conhost, PowerShell, mshta, rundll32, curl, WMI, and WebDAV are extensively used for obfuscation and "Living-off-the-Land" techniques.

Microsoft stated that ClickFix and TerminalFix have become common initial intrusion vectors, impacting thousands of enterprises and individual devices globally every day. These methods are employed by multiple threat actors to distribute malware such as Lumma Stealer, Xworm, AsyncRAT, MintsLoader, potentially leading to credential theft, lateral movement, and ransomware attacks. Microsoft advises users not to follow instructions from CAPTCHAs, webpage errors, emails, or ads prompting them to paste and execute commands in Windows "Run," Terminal, PowerShell, or the command prompt.