ClickFix Campaign Abuses Polygon Blockchain to Shield C2 Servers
Attackers use 'EtherHiding' to dynamically update malware infrastructure, bypassing traditional IP and domain blocking.
A sophisticated malware campaign is leveraging the Polygon blockchain to maintain persistent access to compromised corporate networks. By utilizing the blockchain as a dynamic address book, attackers can shift their command-and-control (C2) infrastructure in real time, making the threat significantly harder for security teams to neutralize.
The campaign, tracked as ErrTraffic, employs a social engineering tactic known as 'ClickFix.' Attackers first compromise business websites—specifically those running WordPress and WooCommerce—to inject malicious JavaScript. When a user visits the site, they are presented with a fake 'Human Verification' or CAPTCHA overlay. This overlay tricks the victim into copying a malicious command and executing it via Windows Run or PowerShell, effectively bypassing browser security warnings to install a dropper framework. Once active, this framework can deploy various malware families, including Vidar, Okobot, and LegionLoader.
The Mechanics of EtherHiding
While ClickFix attacks have been observed for roughly two years, this iteration introduces a shift in infrastructure management through a technique called 'EtherHiding.' The attackers use smart contracts on the Polygon blockchain to store and update C2 addresses. Instead of hardcoding a single server IP into the malware, the infected machine queries the blockchain to find the current active server.
This approach transforms the blockchain into an attacker-controlled directory. Because the blockchain is decentralized and public, the attackers can update the destination server for all infected hosts simultaneously for a negligible cost, ensuring that the malware remains connected even if specific servers are taken offline.
Why Blockchain C2 Matters
Traditional defense strategies rely heavily on blocking known malicious domains or IP addresses. However, the use of EtherHiding renders these static blocks largely ineffective. Because it allows for ad hoc adjustment of C2 details at scale, blocking a singular domain or IP address alone does not permanently sever attacker access.
This level of resilience suggests a higher degree of sophistication than typical infostealer campaigns. By ensuring a stable, flexible connection to compromised hosts, the attackers can maintain long-term access to corporate environments, which is a hallmark of advanced persistent threats or those seeking to establish a foothold for further exploitation.
What to Watch
Security professionals should prioritize the patching of WordPress and WooCommerce vulnerabilities to prevent the initial injection of malicious scripts. Additionally, organizations should monitor for unusual PowerShell activity or the use of the Windows Run dialog (Windows+R) by non-technical users, as these are critical steps in the ClickFix execution chain.
While the technical mechanism of the Polygon-based C2 is confirmed, the full scale of the campaign and the ultimate identity of the operators remain under investigation. The shift toward blockchain-based infrastructure indicates a growing trend where attackers abuse decentralized technologies to evade traditional perimeter defenses.