Microsoft warns BNB Smart Chain malware via fake CAPTCHAs

Microsoft has issued a stark warning about a sophisticated malware campaign exploiting the BNB Smart Chain blockchain to deploy malicious code that is exceptionally difficult to shut down. According to a report from Microsoft Threat Intelligence, the operation, known as ClickFix or TerminalFix, uses a technique called EtherHiding to store payloads within smart contracts, turning the blockchain's inherent immutability into a weapon.

The attack chain begins with the compromise of legitimate websites, often WordPress sites, where attackers inject malicious JavaScript. This script communicates with a smart contract on the BNB Smart Chain, retrieving Base64-encoded instructions. Visitors to these compromised sites are then presented with a fake CAPTCHA prompt that directs them to open a Windows tool like the Run dialog, Terminal, or PowerShell, paste the provided command, and execute it. This action installs information-stealing malware, with the Lumma Stealer being a primary payload observed in the campaign.

The use of blockchain-based infrastructure makes this campaign particularly resilient. Because the malicious instructions are stored in a smart contract, they can only be...