ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain
ClickFix campaign targets 31 organizations using EtherHiding and abusing the Polygon blockchain.
A new malware campaign dubbed ClickFix has successfully compromised 31 organizations by leveraging a technique called EtherHiding. This method allows the malware to dynamically update its command-and-control (C2) server addresses, which are stored and managed on the Polygon blockchain. This abuse of blockchain technology effectively turns it into an attacker-controlled address book, making it harder to track and disrupt the campaign.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe ClickFix campaign exploited the immutable and decentralized nature of the Polygon blockchain to store and rotate command-and-control server addresses using a technique called EtherHiding. Because blockchain transactions cannot be deleted or easily blocked at the source, traditional domain takedown and IP blacklisting defenses are rendered largely ineffective. This represents a significant evolution in attacker tradecraft, where legitimate public infrastructure is weaponized to evade detection and disruption. Organizations that rely solely on static threat intelligence feeds or domain-based blocking failed to detect or intercept the malicious traffic. The campaign's success across 31 organizations underscores a dangerous gap in awareness of emerging evasion techniques and the monitoring of outbound traffic to blockchain RPC endpoints.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ClickFix