According to CoinMeta, Microsoft Threat Intelligence published a statement on the X platform stating that ClickFix and Etherhiding technologies are being used to spread malware, targeting thousands of devices around the world every day. Attackers inject JavaScript to contact BNB Smart Chain RPC gateways to obtain malicious instructions, and use fake verification codes to trick users into executing malicious commands. They also abuse system tools such as conhost, cmd, powershell, and mshta.