As reported by Dark Reading, the ClickFix campaign has compromised at least 31 organizations using a technique dubbed "EtherHiding" — abusing the Polygon blockchain as a dynamically updatable address book for command-and-control (C2) infrastructure. This is not a novelty trick; it is a meaningful evolution in threat actor operational resilience that demands a corresponding evolution in defensive strategy.
Why Blockchain-Based C2 Matters
Traditional C2 infrastructure has a fundamental weakness from the attacker's perspective: it is centralized. A domain can be seized, an IP can be sinkholed, a hosting provider can be compelled to shut down a server. Law enforcement and industry takedown operations — from Trickbot to Emotet to QakBot — have demonstrated that this centralization is exploitable by defenders.
Blockchain-based C2 resolution inverts that dynamic. By embedding C2 addresses in smart contract state on Polygon — a layer-2 blockchain with low transaction fees and fast confirmation times — an attacker creates an address book that is:
This effectively eliminates the traditional takedown vector. You cannot sinkhole a blockchain. You cannot seize a smart contract. The only way to disrupt the C2 channel is to identify and remediate every compromised endpoint — a far more resource-intensive proposition.
The Detection Challenge
From a network defense perspective, this technique is particularly insidious because blockchain RPC traffic is increasingly common in legitimate enterprise environments. Web3 applications, crypto wallets, DeFi platforms, and NFT services all generate traffic to Polygon RPC endpoints. Security teams that blanket-block blockchain RPC traffic risk business disruption, and attackers know this.
The malicious signal is not in where the traffic goes — it is in what is queried and how the response is used. A compromised host querying a specific Polygon contract address and then establishing outbound connections to the resolved IP is the detection pattern that matters.
Who Is Most Exposed
The ClickFix delivery model — which historically relies on social engineering lures presenting fake CAPTCHA verification or software update prompts — disproportionately affects organizations with:
- High user-interaction environments (customer support, content moderation, sales development) where users frequently encounter verification prompts
- Permissive browser policies that allow clipboard access or automatic downloads
- Limited EDR coverage on user workstations, particularly in SMB and mid-market deployments
- Endpoint egress filtering that allows direct connections to arbitrary IPs without proxy mediation
Shield53 Recommendations
Immediate Actions
- Threat hunt for blockchain RPC egress: Search proxy, firewall, and DNS logs for traffic to known Polygon RPC endpoints (polygon-rpc.com, rpc-mainnet.matic.network, rpc.ankr.com/polygon, and similar). Correlate with subsequent outbound connections to newly-seen IPs within a short time window (under 5 minutes).
- Block clipboard-paste execution patterns: The ClickFix delivery chain typically instructs users to paste PowerShell or terminal commands. Deploy application control or EDR rules that flag execution of content originating from clipboard paste events, particularly when preceded by browser activity.
- Monitor for smart contract interaction patterns: If your organization has no legitimate Web3 use case, block Polygon and Ethereum mainnet RPC endpoints at the egress proxy. If legitimate use exists, implement allowlisting of specific contract addresses your business requires and alert on all others.
Strategic Actions
- Incorporate blockchain telemetry into threat intelligence: Threat intel platforms are beginning to support blockchain address monitoring. Integrate feeds that flag contract addresses associated with malware campaigns so your SIEM can alert on any endpoint attempting to query them.
- Reassess takedown playbooks: If your incident response runbooks assume C2 disruption is achievable via hosting provider abuse reports or domain registrar complaints, update them. Blockchain-resolved C2 requires a shift to endpoint-focused remediation as the primary disruption vector.
- User awareness targeting: Train users specifically on the fake-CAPTCHA and fake-update delivery patterns. Generic phishing training is insufficient — ClickFix exploits the trust users place in verification UIs, not email lures.
The strategic takeaway: threat actors are adopting decentralized infrastructure faster than most defensive tooling can adapt. Organizations that continue to treat blockchain as a niche concern rather than a mainstream C2 channel will find their detection gaps widening.
