As cited
Copy frozen at (site build).
threat intel
ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain
A ClickFix campaign has compromised 31 organizations and leverages the Polygon blockchain to update command-and-control infrastructure dynamically. The attackers use EtherHiding to abuse the blockchain as an attacker-controlled address book, allowing them to redirect malware communications without changing deployed payloads.
Why it matters: Security teams managing endpoints should investigate for ClickFix activity and related malware beaconing to blockchain addresses, as the technique enables attackers to persist and pivot within compromised networks by updating control infrastructure on-the-fly.
- Source published
- First seen by Cybersecurity Tracker