Microsoft has uncovered a growing malware campaign that exploits BNB Chain infrastructure to distribute malicious code through compromised websites. The operation tricks visitors into running harmful commands by disguising them as routine security checks.
Consequently, attackers bypass traditional website protections and increase the likelihood of successful infections. The campaign affects both businesses and everyday users, highlighting how cybercriminals continue adapting blockchain technology for malicious purposes instead of legitimate innovation.
Attackers inject hidden scripts into hacked websites and retrieve additional instructions through data stored on BNB Smart Chain. Besides, this approach makes malicious content harder for security teams to remove. Victims encounter fake CAPTCHA pages that instruct them to paste commands into Windows tools.
However, those commands silently launch malware instead of completing verification. Criminals also disguise commands with multiple obfuscation methods and trusted Windows utilities, making suspicious activity appear legitimate during execution.
Microsoft reported that attackers use this technique to spread infostealers, remote access tools, and malware loaders across thousands of devices daily. Moreover, successful infections can expose credentials, establish persistence, and enable ransomware attacks.
Hence, the company recommends enabling Microsoft Defender protections, restricting unnecessary command-line access, and monitoring PowerShell activity. Additionally, users should never paste commands from CAPTCHAs, advertisements, browser warnings, or unsolicited support pages into Windows Run, Terminal, PowerShell, or Command Prompt.
