Microsoft Warns of ClickFix Malware Campaign Abusing Blockchain to Evade Takedowns

Microsoft has issued a security alert about a widespread malware campaign known as ClickFix, which is exploiting smart contracts on the BNB Chain to distribute malicious payloads. Because the malicious code is delivered through blockchain-based contracts rather than traditional servers, it is much harder for security teams to block or remove, since blockchain data cannot simply be taken down like a website.

According to Microsoft, the campaign is compromising thousands of corporate and individual machines every day by exploiting legitimate but compromised websites. Victims are typically tricked into running commands or downloading files that appear routine, a hallmark of ClickFix-style attacks, which often rely on fake error messages or prompts urging users to "fix" a problem on their screen.

The use of blockchain infrastructure to host attack payloads marks a notable shift in tactics, as it allows attackers to keep their malicious content online indefinitely, even if the original website used to lure victims is shut down. This makes the threat particularly persistent and difficult for defenders to fully eliminate.