Microsoft Warns of ClickFix and TerminalFix Combined On-chain Hidden Attacks
Microsoft's threat intelligence team has reported that compromised websites are using ClickFix and TerminalFix to induce attacks, combined with EtherHiding technology, to access smart contracts and obtain malicious commands through the BNB Smart Chain RPC gateway.
Malicious content is stored in on-chain contracts and can only be modified by the wallet owner, making traditional takedown efforts ineffective. Attackers forge CAPTCHA pages to lure users into pasting and executing malicious commands in Windows command windows, Terminal, or PowerShell, widely using system tools for obfuscation and on-the-fly attacks. This method affects thousands of devices globally every day, spreading various malware that could lead to credential leaks, lateral movement, and ransomware. Microsoft advises users not to paste and execute any commands in these interfaces as prompted by web pages.
This incident represents a network attack that enhances malware persistence using blockchain, with a focus on social engineering and on-chain covert commands. Users and enterprise devices are under increased risk from initial intrusion, and security measures need to strengthen monitoring against the abuse of system tools.
Source: Public Information
ABAB AI Insight
ClickFix-type attacks convert users into executioners of attacks by forging verification pages, storing commands in BNB chain smart contracts, significantly enhancing the resilience of infrastructure against strikes. EtherHiding renders traditional domain or server takedowns ineffective.
On the capital path, attackers leverage the low cost and immutability of public chains to maintain malicious infrastructure. The motive is to expand the scale of initial access, paving the way for subsequent data theft and ransomware.
This is an evolution of past activities like ClearFake, currently in a phase where the combination of "social engineering + on-chain anti-censorship" has become a high-frequency tactic.
Essentially, this is a technological substitution: centralized malicious servers are partially replaced by decentralized smart contracts, shifting the mechanism of command distribution from easily blockable nodes to on-chain persistent storage.
ABAB News · Cognitive Laws
Having users run commands themselves is the most efficient initial intrusion.
Malicious commands stored on-chain are harder to remove than those on servers.
The most dangerous prompts often appear to help you verify.