ErrTraffic Campaign Leverages Polygon Blockchain and ClickFix for Stealthy Malware Distribution
Hackers are using the Polygon blockchain to obscure malware infrastructure for the ErrTraffic campaign, tricking users into running malicious commands via the ClickFix technique to steal sensitive data.
A sophisticated malware campaign, dubbed ErrTraffic, is employing the Polygon blockchain to dynamically update and obscure its command-and-control (C2) infrastructure, making it significantly harder for security researchers to track and disrupt. This campaign leverages compromised WordPress websites to present users with deceptive verification prompts, a technique known as ClickFix, which tricks them into executing malicious commands on their systems.
The ClickFix method bypasses traditional exploit vectors by socially engineering users into copying and pasting commands, often into Windows Run boxes or PowerShell consoles. Once executed, these commands can download payloads that steal sensitive information, including browser data, saved credentials, cookies, and cryptocurrency wallet details. WatchGuard analysts identified this activity and linked it to an ErrTraffic malware-as-a-service operation advertised by a threat actor known as LenAI.
The campaign's innovation lies in its use of blockchain technology. Instead of embedding C2 server details directly into compromised websites, the injected JavaScript queries the Polygon blockchain. Through remote procedure calls, it retrieves configuration information from a smart contract, which then directs the compromised site to the current attacker-controlled infrastructure. This method, sometimes referred to as EtherHiding, allows attackers to change their infrastructure without needing to reinfect or reconfigure every compromised website.
This dynamic infrastructure allows ErrTraffic affiliates to rotate delivery paths while maintaining a consistent social-engineering approach. The campaign is notable for distributing a variety of payloads, including Vidar, Okobot, LegionLoader, OnionDrop variants, and BabaDedaLoader. These diverse payloads target different types of data and employ various infection chains, increasing the overall threat posed by the campaign.
For instance, the Vidar infostealer targets browser and wallet data and has been observed communicating via Telegram, Steam, and compromised websites. Some variants have been noted to create remote threads in browsers like Chrome and Edge to exfiltrate data. Other payloads, such as Okobot, have been delivered via ZIP archives containing malicious DLLs, aiming to disable security features like Microsoft Defender and compromise the LSASS process for credential theft.
Defenders are urged to focus on preventing the execution of commands presented through deceptive prompts. Users should never paste commands from CAPTCHA, update, or support pages into command-line interfaces. Administrators are advised to investigate WordPress sites exhibiting suspicious cookies like errtraffic_session, monitor for unexpected PowerShell downloads, and scrutinize browser process injection. Network monitoring should include activity directed at Polygon RPC services following website visits.
Patching web applications and removing injected scripts are crucial steps in reducing the attack surface. The broader implication of the ErrTraffic campaign is the repurposing of legitimate platforms and services, such as blockchains, Windows utilities, and browser processes, as hiding places for malicious infrastructure. Organizations that monitor the entire attack chain, rather than focusing on individual malware families, will be better equipped to detect and respond to evolving threats.