A ClickFix campaign compromised at least 31 organizations while using the Polygon blockchain to help malware locate its command-and-control servers, according to research by GuidePoint Security covered by Dark Reading on September 1, 2026. The technique, known as EtherHiding, uses blockchain smart contracts as an attacker-controlled address book. Infected systems can retrieve an updated server address without requiring a new malware version.

The finding concerns attackers’ use of blockchain infrastructure, not a reported breach of the Polygon protocol. It also does not mean the malware is undetectable. GuidePoint’s narrower point is that blocking a single command-and-control domain or IP address may not permanently disrupt an attacker who can publish a replacement destination for the malware to retrieve.

Compromised Websites and Deceptive Verification Prompts

GuidePoint’s Research and Intelligence Team based its findings on blockchain forensics, incident-response evidence and malware-source analysis. The affected organizations included businesses in e-commerce, professional services and retail logistics. The report distinguishes between a compromised business website and an individual who encounters malicious content on that site. Accordingly, the figure of at least 31 organizations should not be interpreted as a count of infected computers.

Jean-Pierre Mouton, a senior threat intelligence consultant at GuidePoint, said attackers embedded malicious JavaScript in compromised business websites. Search-engine poisoning was also part of the campaign. When a visitor reached an affected page, a gating mechanism assessed the visitor before displaying a deceptive human-verification overlay. The overlay delivered the ClickFix lure, persuading the visitor to execute a command presented as a requirement for continuing.

The familiar appearance of the verification screen was part of the deception. Its resemblance to a Cloudflare check does not establish that Cloudflare itself was compromised. In this campaign, following the lure executed a dropper that contacted a staging server. According to Mouton’s account, the staging server then installed a command-and-control agent and a persistence mechanism.

Polygon Provides a Changing Command Destination

The installed backdoor queried Polygon to obtain its current command-and-control destination. Mouton described the blockchain as an address book controlled by the attacker: the address could change while the malware on the infected machine remained unchanged. This separated the server destination from a fixed address that defenders could otherwise block once.

Mouton said the attacker could redirect infected machines to a new server for fractions of a cent per transaction. The research also described a backdoor that survived reboots and sent a beacon to its controller every minute. These are reported characteristics of the malware investigated by the team. They do not indicate that every program using Polygon behaves this way or that every Polygon connection is malicious.

The team discovered the blockchain connection during what it initially believed was a standard business email compromise investigation. A persistence script contacted Polygon, and subsequent analysis and investigation revealed the EtherHiding infrastructure. Mouton told Dark Reading that earlier EtherHiding activity had mostly involved Binance or Ethereum, making the use of Polygon smart contracts a distinguishing feature of this campaign.

Assessment of the Unidentified Actor

Mouton assessed the unidentified actor as likely being an initial-access broker. That assessment does not establish the actor’s identity. The combination of a dropper, persistent access and a changing command destination differs from the more familiar ClickFix pattern he described, in which an information-stealing payload depends on a controller that defenders can block.

The source also discusses possible methods used to compromise business websites, including mass exploitation of a WordPress vulnerability or another mechanism. It does not identify a specific WordPress vulnerability used in these incidents. References to WooCommerce and Magento concern a separate Magecart campaign and should not be treated as a platform list for this ClickFix investigation.

Defensive Measures Before and After Infection

In Dark Reading’s account of the research, Mouton recommended employee training focused specifically on ClickFix and other social-engineering tactics. The initial deception remains significant even though blockchain infrastructure appears later in the attack. Recognizing a page that asks a visitor to execute a supposed verification command could interrupt the attack before subsequent stages.

His technical recommendations included PowerShell logging with effective alerting for potentially malicious scripts. He also recommended restricting access to blockchain-query endpoints where business requirements allow. That qualification is relevant to organizations that legitimately use blockchain services; the recommendation is not an unconditional ban on all such traffic.

Mouton said blocking the specific RPC endpoints hardcoded into this strain’s PowerShell script would sever its route to the controller. That is a targeted defensive measure, distinct from blocking a single replaceable server address. The reported lesson is that defenders need to understand how malware obtains its destination while also addressing the deceptive prompt and script execution that precede the communication.

Source: Blocktelegraph.