Cybersecurity researchers have identified a malware operation that leverages the Polygon blockchain to hide critical components of its delivery infrastructure, significantly complicating takedown efforts.

The campaign, designated ErrTraffic, targets WordPress websites and repurposes them as distribution points for counterfeit verification pages. WordPress powers roughly 40% of all websites globally, making it an especially attractive surface for compromises of this nature. Visitors to compromised sites encounter prompts designed to resemble legitimate browser checks or CAPTCHA verifications, and are socially engineered into manually executing Windows commands. This approach, referred to as ClickFix, depends on manipulating user behavior rather than exploiting software vulnerabilities.

Once a victim complies with the instructions and runs the command, malware is downloaded to their system. The consequences vary by payload but can include the theft of browser data, stored credentials, session cookies, and cryptocurrency wallet information.

WatchGuard researchers detected the activity through telemetry data and attributed it to an ErrTraffic malware-as-a-service operation advertised on forums by a user operating under the alias LenAI. The infrastructure was found distributing multiple malware families, including Vidar, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader.

Polygon Smart Contracts Used to Mask Infrastructure

The attack chain begins when a user visits an infected WordPress site. Malicious JavaScript embedded in the page conceals the attacker's actual endpoint, instead communicating with the Polygon network via remote procedure call (RPC) services to retrieve configuration data stored within a smart contract.

That stored data directs the attack to the attacker's current infrastructure. This method, widely known as EtherHiding, poses significant challenges for law enforcement and security teams because attackers can update the blockchain-stored configuration without modifying the malicious code on each compromised website. Because smart contracts on public blockchains are replicated across a decentralized network of nodes, there is no single host or registrar that authorities can compel to remove the data—a structural advantage for attackers that traditional domain or IP-based takedowns cannot address.

The infrastructure further incorporates traffic routing and geolocation-based filtering, enabling operators to selectively determine which visitors are served malicious content. This architecture permits different affiliates to modify delivery pathways while retaining the same underlying social-engineering framework.

The final-stage PowerShell command may fetch a randomly named 7-Zip executable alongside a similarly randomized payload, or it may retrieve the malicious payload directly. By design, the victim initiates the execution step, reducing the attacker's reliance on traditional software exploits.

Multiple Malware Families Amplify the Threat

The diversity of payloads delivered through this campaign substantially increases the risk profile. Vidar, for instance, is capable of harvesting browser and cryptocurrency wallet data. Researchers observed specific Vidar variants communicating through Telegram, Steam, and a compromised Brazilian website.

A separate Vidar variant was found creating remote threads within Google Chrome and Microsoft Edge processes, a technique that could enable attackers to extract sensitive information maintained by those browsers.

Okobot was also identified within the campaign. It was delivered via a ZIP archive containing a file named Volume2 and a malicious DLL. Investigators determined that Okobot attempts to degrade Microsoft Defender protections and interfere with security controls surrounding LSASS, the Windows process responsible for managing authentication credentials.

Additional components included a malicious MSI package deploying a Node.js backdoor that communicated over Tor for command-and-control operations. Researchers also documented OnionDrop variants employing DLL side-loading to mask malicious activity behind legitimate applications.

Further infection chains were linked to LegionLoader and BabaDedaLoader, confirming that the infrastructure is designed to accommodate multiple malware families concurrently rather than serving a single threat. The concurrent distribution model reflects the broader malware-as-a-service ecosystem, where operators rent out delivery infrastructure to multiple criminal affiliates who each bring their own payloads.

Security Teams Advised to Monitor the Full Attack Chain

Defenders are encouraged to prioritize blocking fake verification prompts from becoming execution vectors and to investigate anomalous PowerShell activity, browser process injection attempts, and suspicious downloads following visits to potentially compromised websites.

Organizations can also monitor for WordPress sites that set the errtraffic_session cookie and scrutinize network connections to Polygon RPC endpoints occurring immediately after visits to dubious pages. Newly created DLL files and unexpected downloads may serve as additional indicators of compromise.

Maintaining up-to-date WordPress installations, plugins, and themes, combined with the removal of injected scripts, can reduce the pool of websites available for exploitation.

The campaign underscores a broader trend in cybercrime where legitimate technologies are co-opted to obscure malicious operations. Blockchain infrastructure, built-in Windows utilities, browser processes, and trusted websites each fulfill a narrow role within the attack, yet their integration makes the overall operation considerably more difficult to detect and dismantle. As EtherHiding techniques mature, defenders may encounter similar abuse expanding to other EVM-compatible networks beyond Polygon, since the underlying approach of storing configuration data in smart contracts is not chain-specific.

Security experts recommend that organizations monitor the complete infection chain rather than focusing on individual malware families, as this approach offers a stronger likelihood of identifying future ErrTraffic variants.

Source: CoinTrust