Hackers Hide Malware Infrastructure on Polygon Blockchain and Trick Users Into Running It With ClickFix
Brief
Hackers are using the Polygon blockchain to keep parts of a malware operation out of plain sight.
The campaign, tracked as ErrTraffic, turns hacked WordPress sites into launch points for fake verification prompts that persuade visitors to run harmful Windows commands.
The trick is known as ClickFix. Instead of exploiting a software flaw, the page tells a visitor to copy and paste a supposed fix, often into the Windows Run box or PowerShell.
That single action can download a payload, giving criminals access to browser data, saved credentials, cookies, and cryptocurrency-wallet information.
WatchGuard analysts identified the activity in telemetry and linked it to an ErrTraffic malware-as-a-service operation advertised by a forum user known as LenAI.