Microsoft flags ClickFix malware using BNB Chain to fetch attack instructions
Microsoft has warned of ClickFix attacks using BNB Chain smart contracts to infect thousands of devices every day. According to Microsoft Threat Intelligence, a cluster of compromised websites has been using ClickFix lures together with the EtherHiding technique to deliver malware, with campaigns targeting thousands of enterprise and consumer devices worldwide each day. Microsoft Threat Intelligence has identified a cluster of compromised websites displaying ClickFix lures and using EtherHiding, a technique associated with the ClearFake campaign. An injected Base64-encoded JavaScript contacts a BNB Smart Chain RPC gateway to query a smart… pic.twitter.com/FOivGuUxVV — Microsoft Threat Intelligence (@MsftSecIntel) August 6, 2026 The security team said attackers inject Base64-encoded JavaScript into compromised websites. Instead of retrieving payload instructions from a traditional server, the script connects to a BNB Smart Chain RPC gateway and queries a smart contract previously linked to the ClearFake campaign. Because only the owner of the cryptocurrency wallet that deployed the contract can modify its contents, the instructions remain difficult to remove using conventional takedown or sinkholing methods. Microsoft said victims are shown a fake CAPTCHA asking them to verify they are human. Instead of completing a normal verification step, users are instructed to open the Windows Run dialog, paste clipboard content, and press Enter, executing
