ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain

Summary

A new malware campaign dubbed ClickFix has successfully compromised 31 organizations by leveraging a technique called EtherHiding. This method allows the malware to dynamically update its command-and-control (C2) server addresses, which are stored and managed on the Polygon blockchain. This abuse of blockchain technology effectively turns it into an attacker-controlled address book, making it harder to track and disrupt the campaign.

Indicators of Compromise

• malware — ClickFix

Entities