ClickFix Users Exposed to Malware via Polygon Blockchain Infrastructure

Key Takeaways

• A malware campaign, dubbed “ErrTraffic,” is leveraging the Polygon blockchain to conceal its command-and-control infrastructure.
• The attack chain, known as ClickFix, tricks users into executing malicious Windows commands through deceptive prompts on compromised WordPress sites.
• Victims who fall for the ruse risk exposing sensitive data, including browser information, saved credentials, cookies, and cryptocurrency wallet details.
• The campaign distributes multiple potent payloads, such as Vidar, Okobot, LegionLoader, OnionDrop-related malware, and BabaDedaLoader.
• Defenders must prioritize user education against executing untrusted commands and implement robust monitoring for blockchain interactions and unusual system activity.

Cybersecurity researchers have uncovered a sophisticated malware operation, designated ErrTraffic, that cleverly utilizes the Polygon blockchain to obscure its critical infrastructure. This innovative tactic allows threat actors to maintain persistence and agility, making detection and takedown efforts significantly more challenging.

The campaign employs a social engineering technique known as ClickFix. Instead of exploiting software vulnerabilities, it manipulates users into manually executing malicious commands. This method is delivered via compromised WordPress websites, which serve as initial infection points.

The ClickFix Deception and its Consequences

Upon visiting a compromised WordPress site, users are presented with convincing, fake verification prompts. These lures instruct visitors to copy and paste purported “fixes” into Windows system interfaces like the Run box or PowerShell. This seemingly innocuous action is, in fact, the critical step that downloads a malicious payload onto the victim’s system.

Once executed, this payload grants attackers unauthorized access to a wealth of sensitive information. This includes browser data, stored credentials, cookies, and cryptocurrency wallet details, posing a severe risk of financial and data theft.

Analysts at WatchGuard identified this activity within their telemetry, linking it directly to an ErrTraffic malware-as-a-service operation. This service is reportedly advertised by a forum user known as LenAI. Their findings reveal a single delivery mechanism capable of distributing a diverse array of threats, including Vidar, Okobot, LegionLoader, various OnionDrop-related payloads, and BabaDedaLoader.

The efficacy of this campaign stems from its combination of persuasive social engineering and a highly adaptable infrastructure. As WatchGuard said in a report, a compromised website can appear entirely normal until its injected code delivers the deceptive prompt. This stealthy approach ensures a high success rate for initial compromise.

Hackers Hide Malware Infrastructure on Polygon Blockchain

The ErrTraffic attack chain initiates when a user lands on an infected WordPress site. The JavaScript injected into the site does not directly reveal the final malware destination. Instead, it queries the Polygon blockchain via remote procedure call (RPC) services. From a smart contract on Polygon, it retrieves configuration data that points to the current, attacker-controlled infrastructure.

This technique, often referred to as EtherHiding, significantly complicates efforts to dismantle the malware’s infrastructure. By storing critical command-and-control (C2) information on the blockchain, operators can rapidly update their infrastructure details within the smart contract without needing to modify every compromised website. This forces defenders to look beyond the immediate web page for indicators of compromise, mirroring challenges seen in other advanced traffic broker campaigns.

After retrieving the C2 information, the lure prompts the user to complete a fake browser or CAPTCHA-style check. The PowerShell command provided by the attackers can either download a randomly named 7-Zip program along with a randomly named payload, or directly fetch the payload. In either scenario, the victim is tricked into performing the execution step, thereby installing the malware.

The entire framework leverages traffic routing, location-based filtering, and blockchain-backed resolution. This sophisticated design enables affiliates to frequently alter their delivery paths while maintaining the same effective social engineering tactics.

Multiple Payloads Raise the Stakes

The variety and potency of the payloads distributed by ErrTraffic are particularly concerning. Vidar, for instance, is an information stealer designed to exfiltrate browser data and cryptocurrency wallet information. It has been observed communicating with its C2 servers through Telegram channels, Steam profiles, and even a compromised Brazilian website. One variant of Vidar was noted for creating remote threads within Chrome and Edge, potentially exposing sensitive data from these browsers.

Other instances demonstrate the attackers’ ability to diversify their post-compromise activities. The Okobot malware, for example, was delivered via a ZIP archive containing Volume2 and a malicious DLL. It then attempted to disable Microsoft Defender settings and remove protections around LSASS, a critical Windows process that holds sensitive login credentials. This pattern is reminiscent of recent ClickFix MSI delivery attacks, where a deceptive prompt transforms routine user interaction into malware execution.

Researchers also discovered a malicious MSI package containing a Node.js backdoor that utilized Tor for its command-and-control communications. Furthermore, variants of OnionDrop were found hiding behind legitimate programs through DLL side-loading. One particular Go-based variant connected to infrastructure associated with LegionLoader, while another infection chain employed Windows compilation tools to ultimately deliver a BabaDedaLoader payload.

What You Should Do

• Educate Users: Emphasize to all users that they should never copy and paste commands from unexpected browser prompts, CAPTCHA requests, update notices, or support pages into Windows Run, Terminal, or PowerShell. Legitimate software updates or fixes will typically install through official installers, not manual command execution.
• Monitor WordPress Sites: Administrators should vigilantly monitor WordPress sites for the presence of the errtraffic_session cookie. Any unexpected appearance of this cookie warrants immediate investigation.
• Review PowerShell Activity: Implement logging and monitoring for PowerShell commands, particularly those involving unusual downloads or script executions. Investigate any PowerShell activity that retrieves files from suspicious or unknown sources.
• Detect Browser Process Injection: Look for signs of suspicious process injection into legitimate browser processes (e.g., Chrome, Edge, Firefox). This could indicate the presence of info-stealing malware like Vidar.
• Inspect Network Traffic: Specifically monitor network activity that attempts to reach Polygon RPC services immediately after visits to any potentially compromised websites. Correlate this with any unusual file downloads or the creation of new DLLs on endpoint systems.
• Patch and Secure Web Applications: Ensure all web applications, especially WordPress installations and their plugins, are kept up-to-date with the latest security patches to mitigate injection vulnerabilities. Regularly audit websites for unauthorized injected scripts.
• Comprehensive Threat Monitoring: Adopt a holistic approach to threat detection, focusing on monitoring the entire kill chain rather than isolating individual malware names. This includes observing traffic routing, location-based filtering, and blockchain interactions to identify evolving attack patterns.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.