ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain

According to reporting from Dark Reading, a cybersecurity campaign codenamed ClickFix has compromised 31 organizations by exploiting the Polygon blockchain. The attack chain leverages EtherHiding malware, which uses blockchain transactions to dynamically refresh its command-and-control (C2) server addresses. By storing updated C2 information on the decentralized ledger, the malware can retrieve new instructions without relying on static IP domains or IP addresses that are susceptible to blocking by security appliances.

The use of the Polygon network as an "attacker-controlled address book" allows the threat actors to maintain persistence and evade detection. Traditional security controls that monitor outbound traffic for known malicious domains or IPs are less effective when the signaling mechanism resides on a legitimate blockchain. The campaign's activity was first reported with a publication date of September 1, 2026.

The exploitation of blockchain infrastructure for C2 purposes represents a evolving tactic in the threat landscape. Security analysts note that while the blockchain provides resilience against takedowns, it also introduces new vectors for detection and mitigation. The specific industries targeted and the precise methods of initial access have not been independently verified and are listed as reported but unconfirmed in the source material.