GoKawiil31 Organizations Hit in ClickFix Attack Using Polygon Blockchain to Hide C2 Servers
GuidePoint Security's research team found that attackers have breached at least 31 organizations—spanning e-commerce, professional services, and retail logistics—using a ClickFix campaign that leverages the Polygon blockchain to conceal command-and-control infrastructure. The technique, dubbed EtherHiding, lets attackers dynamically update C2 server locations via blockchain transactions instead of relying on a single fixed address.
GoKawiil's interpretation of the reporting above, not reported fact.
By storing C2 details on a public, immutable ledger, attackers gain a resilient infrastructure that can't be shut down simply by blocking one domain or IP, since new server addresses can be pushed out for fractions of a cent. This marks an evolution in cybercrime tactics, expanding EtherHiding beyond Bitcoin and Ethereum into Polygon's smart contracts, which could make blockchain-abuse techniques more accessible and harder for defenders to disrupt at scale.
- At least 31 organizations across e-commerce, professional services, and logistics have been compromised.
- Attackers use Polygon blockchain smart contracts to dynamically change C2 servers, evading traditional blocking methods.
- This is a new variant of EtherHiding, previously seen mainly on Bitcoin and Ethereum networks.
YubiKey 5 NFC Security Key — Campaigns like ClickFix ultimately aim at stealing credentials and sessions, and a hardware security key is one of the strongest defenses against that. The YubiKey 5 NFC plugs into USB-A or taps NFC-enabled phones for phishing-resistant sign-in across major accounts and password managers. It's a pocket-sized upgrade to your personal and workplace security posture.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Elizabeth Montalbano, 2026-09-01
Published there as: “ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.