Microsoft discovers ClickFix attack using BNB Smart Chain to host malicious instructions

Microsoft Threat Intelligence released a statement on the X platform stating that ClickFix and EtherHiding technologies are being used to spread malware, targeting thousands of devices worldwide every day. The attacker contacts the BNB Smart Chain RPC gateway by injecting JavaScript to obtain malicious instructions, and uses fake captcha to trick users into executing malicious commands, while abusing system tools such as conhost, cmd, PowerShell, and mshta.