Hackers are using BNB Chain contracts to spread malware through compromised websites and fake CAPTCHA prompts, according to a report by Microsoft Threat Intelligence.
Storing the instructions on a blockchain network makes them harder to remove. Only the wallet controlling the contract can change its contents, limiting the effectiveness of conventional takedowns.
Visitors to compromised websites see a fake CAPTCHA telling them to open the Windows Run dialog, paste text from their clipboard, and press Enter. Doing so runs a command supplied by the attacker.
“This campaign demonstrates that ClickFix and TerminalFix are a high-volume initial access technique,” Microsoft researchers wrote. “Microsoft reports campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains can funnel visitors to scam pages.”
According to Microsoft, hackers hide their commands and abuse legitimate Windows tools, including PowerShell, cmd, mshta, rundll32, msiexec, curl, Windows Management Instrumentation, and scheduled tasks. A successful infection can expose passwords, establish lasting access, help hackers move through a network, and lead to ransomware or broader network compromise.
The use of blockchains to support malware attacks is not new.
In other words, the problem is not unique to BNB Chain. But it’s notable that Microsoft’s threat team has chosen to highlight what appears to be an ongoing issue.
Microsoft advised organizations to restrict unnecessary command-line tools, enable PowerShell logging, and use application controls.
“Users should never paste commands from CAPTCHAs, browser errors, emails, ads, or unsolicited support pages into Run, Terminal, PowerShell, or Command prompt,” Microsoft said.
