Microsoft flags BNB Smart Chain contracts used as malware command hub
Security & Exploits ·
Microsoft Threat Intelligence says a group of compromised websites is querying a BNB Smart Chain smart contract to retrieve malicious follow-up commands, a technique the company links to the ClearFake campaign.
The websites display fake CAPTCHA prompts, part of a technique Microsoft calls ClickFix, and inject Base64-encoded JavaScript that reaches out to a BNB Smart Chain RPC gateway, according to Microsoft Threat Intelligence. That script queries a smart contract previously tied to ClearFake to pull the next stage of instructions. Because only the wallet that deployed a contract can alter its contents, Microsoft notes this setup is resistant to typical takedown or sinkhole efforts used against malicious infrastructure.
Visitors to the affected sites are shown a fake verification prompt urging them to open the Windows Run dialog, paste clipboard text, and hit enter, which executes an attacker-chosen command. Microsoft has also observed a related lure, TerminalFix, that pushes the same trick through Windows Terminal or PowerShell instead. The company describes seeing layered obfuscation methods across these campaigns, including split keywords, hidden interpreter calls via environment variables, and tools such as conhost, cmd, mshta, rundll32, msiexec, curl, WMI, WebDAV and scheduled tasks used to mask execution.
Microsoft characterizes ClickFix and TerminalFix as high-volume entry points, with campaigns hitting thousands of enterprise and consumer devices worldwide daily, sometimes fed by malvertising chains that redirect users to scam pages. The payloads observed include infostealers like Lumma Stealer, remote access trojans such as Xworm and AsyncRAT, loaders including MintsLoader, and legitimate remote management software repurposed for intrusion. Microsoft warns that a single successful run can expose stored credentials, plant persistence mechanisms, and open a path toward lateral movement, human-operated ransomware, and broader domain compromise, a dynamic also noted by wublockchain.xyz.
To counter the technique, Microsoft is recommending organizations turn on Defender's network, web, and cloud-delivered protections, restrict access to Run and other command-line tools where unnecessary, enable PowerShell script-block logging, and apply application control policies. Its guidance to individual users is direct: never paste text from a CAPTCHA, browser error, email, ad, or unsolicited support page into Run, Terminal, PowerShell, or Command Prompt.
What remains unclear is the scale of the wallet or wallets controlling the implicated smart contract, how long this particular infrastructure has been active, and whether other blockchains are being tested for similar command-and-control use. Microsoft has outlined detection signals within its own Defender suite, including alerts tied to RunMRU registry activity and ClickFix-specific antivirus detections, but has not disclosed attribution to a specific threat actor or group behind the campaign.