A sophisticated ClickFix campaign has compromised 31 organizations by utilizing the Polygon blockchain. Through a technique called 'EtherHiding,' attackers are dynamically updating C2 servers to evade detection.
- 31+ organizations across e-commerce and logistics compromised.
- Polygon blockchain used as a dynamic C2 address book via 'EtherHiding'.
- Attackers utilize fake CloudFlare verification overlays to trick users.
In a startling escalation of cyber warfare, a new 'ClickFix' campaign has successfully compromised at least 31 organizations. According to a detailed report by GuidePoint Security’s Research and Intelligence Team (GRIT), the attackers are leveraging the Polygon blockchain to automate and obscure their malicious activities, making traditional detection methods nearly obsolete.
The core of this operation is a technique known as 'EtherHiding.' While most malware relies on a fixed Command-and-Control (C2) server address—which security teams can identify and block—this campaign uses the permanent, distributed ledger of the Polygon cryptocurrency blockchain. By doing so, the attackers can dynamically update their C2 server addresses in real-time, effectively treating the blockchain as an attacker-controlled address book.
Why This Matters
BozokMedia analysis shows that this shift represents a strategic evolution in how Initial Access Brokers (IABs) operate. By integrating Web3 infrastructure into their kill chain, attackers are removing the 'single point of failure' (the C2 domain). This means that blocking a single IP address no longer severs the attacker's access, creating a persistent threat that can survive reboots and security scans with minimal operational cost to the adversary.
"Because it allows for ad hoc adjustment of C2 details at scale, blocking a singular domain or IP address alone does not permanently sever attacker access." - Jean-Pierre Mouton, GuidePoint Security.
The attack vector is dual-pronged. First, the attackers compromise a legitimate business website—often through WordPress vulnerabilities—and inject malicious JavaScript. When a victim visits the site, they are presented with a fake 'Human Verification' overlay that mimics CloudFlare. The lure instructs the user to press Windows+R, Ctrl+V, and Enter, which executes a malicious dropper on the victim's machine.
Unlike typical ClickFix campaigns that deploy simple infostealers, this variant installs a sophisticated dropper that contacts a staging server to deploy a C2 agent. This agent then queries the Polygon blockchain to find the current destination for its beacons, ensuring the connection remains active even if the primary server is taken down.
| Feature | Standard ClickFix Attack | Polygon-based Attack |
|---|---|---|
| C2 Infrastructure | Static IP/Domain | Dynamic (Blockchain-based) |
| Detectability | Easily blocked via DNS/IP | High evasion (EtherHiding) |
| Payload Type | Infostealer | Dropper & Persistence Agent |
Frequently Asked Questions
1. How does EtherHiding work? It uses the public blockchain as a decentralized storage for C2 addresses, allowing the malware to fetch new server locations without needing an update to its own code.
2. Which industries are most at risk? Currently, e-commerce, professional services, and retail logistics have been the primary targets.
