ClickFix Campaign Abuses Polygon Blockchain for Stealthy Command-and-Control
A sophisticated ClickFix campaign is compromising organizations by using the Polygon blockchain to dynamically update its command-and-control infrastructure, making it harder to block.
A new wave of cyberattacks, tracked as the ClickFix campaign, has successfully compromised at least 31 organizations by ingeniously leveraging the Polygon blockchain for its command-and-control (C2) infrastructure. This campaign employs a technique known as "EtherHiding," which utilizes the immutable nature of blockchain ledgers to dynamically update C2 server addresses, thereby evading traditional detection and blocking methods.
The attackers are targeting a diverse range of industries, including e-commerce, professional services, and retail logistics, according to a recent report by GuidePoint Security’s Research and Intelligence Team (GRIT). Unlike typical ClickFix campaigns where blocking a single C2 server address can neutralize the threat, this operation's reliance on the blockchain allows for near-instantaneous and cost-effective redirection of infected machines to new C2 servers for fractions of a cent per transaction.
While EtherHiding is not entirely new, its application in this campaign is distinguished by the use of the Polygon blockchain, a departure from previous instances that primarily utilized Ethereum or Binance. This specific implementation allows for "ad hoc adjustment of C2 details at scale," making it significantly more resilient to takedowns.
Furthermore, the ClickFix campaign introduces novel tactics beyond its C2 infrastructure. Attackers are employing a Search Engine Poisoning system and malicious JavaScript injection to abuse Cloudflare's standard human verification overlay. This method bypasses the need for redirecting victims to separate malicious landing pages, instead presenting a seemingly legitimate verification step that, when completed, initiates the attack.
The payload delivery also deviates from the norm. Instead of directly deploying an infostealer, this campaign uses a dropper that contacts a staging server to install the C2 agent and establish persistence. This suggests the threat actor may be an initial access broker (IAB) rather than a standard ClickFix operator.
The attack vector operates on two fronts: compromising legitimate business websites to host the malicious JavaScript and then targeting end-users who visit these sites. The initial compromise of websites often occurs at scale, potentially through mass exploitation of vulnerabilities in platforms like WordPress. Once a user visits a compromised site and encounters the "Human Verification" overlay, they are prompted to execute specific commands, which triggers the malware dropper.
Upon execution, the malware queries the Polygon blockchain for its current C2 destination. This sophisticated approach ensures that even if the initial C2 address is discovered, the malware can automatically retrieve an updated address from the blockchain, maintaining persistent communication and control. The research team discovered this novel tactic during what initially appeared to be a Business Email Compromise (BEC) investigation, highlighting the campaign's stealth and adaptability.
The ultimate goal of the ClickFix campaign, despite its evolving tactics, remains to trick users into executing malicious commands. The use of blockchain for C2 and the novel social engineering techniques underscore a growing trend of attackers seeking more resilient and evasive methods to compromise organizations.