Microsoft says ClickFix attacks hide commands in blockchain smart contracts

Microsoft Threat Intelligence said it has identified a set of compromised websites using ClickFix bait and an EtherHiding technique tied to the ClearFake campaign. The attackers inject Base64-encoded JavaScript, then use a BNB Smart Chain RPC gateway to query a smart contract for the next-stage instructions. Because the commands are stored in a smart contract, Microsoft said they are difficult to remove through traditional takedown methods. The attack chain shows a fake CAPTCHA, then tries to persuade users to open the Windows Run dialog, paste the command, and execute it. Microsoft said the technique has been used to deliver Lumma Stealer and other information-stealing malware, as well as remote access trojans. The company said the activity affects thousands of devices globally each day. Microsoft advised users not to paste commands that come from CAPTCHA prompts and to enable the relevant Defender protections.