Hackers Use BNB Chain to Spread Malware Through Fake CAPTCHAs
Hackers are using BNB Chain smart contracts to deliver malware through compromised websites and fake CAPTCHA prompts. The campaign uses EtherHiding, storing malicious commands on-chain so they are harder to remove and can only be changed by the wallet controlling the contract. When users visit infected sites, injected JavaScript fetches instructions from the blockchain and shows a fake CAPTCHA that tells them to open Windows Run, Terminal, or PowerShell and paste a command. This “ClickFix” or “TerminalFix” approach tricks victims into executing the payload themselves. Microsoft says the tactic is a high-volume initial access method and often abuses legitimate Windows tools such as PowerShell, cmd, mshta, rundll32, msiexec, curl, WMI, and scheduled tasks. Successful infections can steal credentials, establish persistence, enable lateral movement, and lead to ransomware or broader compromise. Microsoft recommends restricting command-line tools, enabling PowerShell logging, using application controls, and never pasting commands from CAPTCHAs, ads, emails, or unsolicited support pages.
