Microsoft Threat Intelligence: ClickFix Attackers Exploit Blockchain Smart Contracts to Evade Takedowns
Key Takeaways
- •The Windows component uses EtherHiding to embed malicious payloads in BNB Smart Chain smart contracts, which cannot be removed through conventional server takedowns since only the deploying wallet owner can modify their contents.
- •Victims on Windows are deceived by fake CAPTCHAs into pasting attacker-supplied commands into the Run dialog, triggering multi-stage execution chains that abuse native utilities such as PowerShell, mshta, rundll32, msiexec, and curl.
- •A parallel macOS operation across more than 250 algorithmically named domains employs browser fingerprinting to deliver malicious terminal commands exclusively to genuine macOS users while serving harmless decoys to sandboxes and automated scanners.
- •The campaigns distribute malware including Lumma Stealer, AsyncRAT, Xworm, MintsLoader, Atomic Stealer, and MacSync, which harvest credentials, cryptocurrency wallets, keychain data, and SSH keys.
- •Automated web-content scanning and sandbox-based analysis may fail to capture the malicious payloads, underscoring the importance of end-user awareness training as a complementary defensive control.
Microsoft Threat Intelligence has released findings on an evolving ClickFix attack campaign that now uses blockchain infrastructure and sophisticated browser fingerprinting to compromise Windows and macOS systems at scale. The campaign illustrates a broader trend in which threat actors co-opt decentralized infrastructure to frustrate conventional remediation, extending a pattern of abuse first observed with the ClearFake campaign's use of compromised websites.
Windows Operations Leverage EtherHiding on BNB Smart Chain
The Windows-focused component of the campaign employs a technique known as EtherHiding, which stores malicious commands directly within smart contracts deployed on the BNB Smart Chain. EtherHiding was publicly documented in late 2023 by Guardio Labs as an evolution of the ClearFake campaign, and its adoption by additional threat clusters signals that this approach is spreading beyond its originators. Attackers inject Base64-encoded JavaScript into compromised websites; this code queries the on-chain smart contracts through RPC gateways to retrieve next-stage instructions.
Because the malicious payload resides on-chain, it cannot be eliminated through conventional takedown or sinkholing methods. Only the owner of the deploying cryptocurrency wallet has the ability to modify the contract's contents. This shifts the remediation challenge from disabling a server to coordinating with blockchain infrastructure operators—a materially different problem for defenders.
Victims are shown fake CAPTCHAs that instruct them to open the Windows Run dialog and paste commands supplied by the attackers. The resulting execution chains abuse native system utilities, including PowerShell, mshta, rundll32, msiexec, and curl. These chains frequently employ caret splitting and environment variable obfuscation techniques to evade security detection.
Microsoft reports that these campaigns target thousands of enterprise and consumer devices globally each day, delivering payloads such as Lumma Stealer, Xworm, AsyncRAT, and MintsLoader. Lumma Stealer and AsyncRAT are widely available under malware-as-a-service arrangements, lowering the barrier to entry for criminal operators. According to Microsoft, a single successful infection can expose credentials, establish persistence, enable lateral movement within a network, and create pathways to human-operated ransomware.
Microsoft Threat Intelligence has identified a cluster of compromised websites displaying ClickFix lures and using EtherHiding, a technique associated with the ClearFake campaign. An injected Base64-encoded JavaScript contacts a BNB Smart Chain RPC gateway to query a smart… pic.twitter.com/FOivGuUxVV
— Microsoft Threat Intelligence (@MsftSecIntel) August 6, 2026
macOS Operations Deploy Anti-Analysis Fingerprinting Gates
In parallel, Microsoft tracked a macOS ClickFix cluster that has shifted from openly serving malicious terminal commands to concealing them behind server-side browser fingerprinting gates. The operation spans more than 250 domains, many of which follow algorithmic naming patterns such as "filewordword" constructions.
When a visitor arrives at one of these domains, a lightweight JavaScript profiling routine collects browser attributes, WebGL GPU signals, timezone offsets, and iframe context, then submits this fingerprint to the server for evaluation. Requests that fail these checks—such as those originating from sandboxes, virtual machines, or non-macOS browsers—receive benign decoy pages or blank content. Genuine macOS visitors, by contrast, are shown a counterfeit "Verified Publisher" download page containing a malicious terminal command.
This traffic distribution system delivers information stealers including MacSync and Atomic Stealer, which are designed to harvest keychain data, browser credentials, cryptocurrency wallets, and SSH keys. Atomic Stealer, also tracked as AMOS, has emerged as one of the most commercially active macOS malware families, advertised on cybercrime forums and repeatedly updated to target additional wallet extensions and credential stores.
While the fingerprinting techniques themselves are not novel, their integration into ClickFix infrastructure complicates automated detection and analysis by serving malicious content exclusively to selectively qualified victims. Organizations relying on automated web-content scanning or sandbox-based threat analysis may fail to capture the malicious payloads these campaigns deliver, underscoring the value of end-user awareness training as a complementary control.