[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f27AlWSqdnjlmNoQAGmWA4XUu-KVs7m8BfZK4fFdiuEk":3},{"article":4,"iocs":40,"watch_terms":44,"solutions":45,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"59228901-ab84-465b-a341-fc346e4d7ec6","ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain","clickfix-campaign-compromises-31-orgs-abuses-polygon-blockchain-c4b7fe","The campaign uses EtherHiding to dynamically update its command-and-control server, abusing the blockchain as an attacker-controlled address book.","A new malware campaign dubbed ClickFix has successfully compromised 31 organizations by leveraging a technique called EtherHiding. This method allows the malware to dynamically update its command-and-control (C2) server addresses, which are stored and managed on the Polygon blockchain. This abuse of blockchain technology effectively turns it into an attacker-controlled address book, making it harder to track and disrupt the campaign.","ClickFix campaign targets 31 organizations using EtherHiding and abusing the Polygon blockchain.","https:\u002F\u002Fwww.darkreading.com\u002Fendpoint-security\u002Fclickfix-campaign-comprises-31-orgs-abuses-polygon-blockchain","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt6a0f2dc67da094b0\u002F6a96c86cc735cc0c3671a7e3\u002Fblockchain_incamerastock_alamy.png?width=720&quality=80&disable=upscale","2026-09-01T13:56:42+00:00","2026-09-01T16:00:09.366551+00:00",7,[17,20],{"name":18,"type":19},"EtherHiding","technology",{"name":21,"type":19},"Polygon blockchain","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":22,"icon":24,"name":25,"slug":26},null,"Malware","malware",[28,33,35],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":22,"icon":24,"name":25,"slug":26},{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41],{"type":26,"value":42,"context":43},"ClickFix","Name of the malware campaign",[],{"controls":46,"vendors":130},[47,76,101],{"slug":48,"name":49,"problem":50,"products":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":39,"name":77,"problem":78,"products":79},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[80,85,93],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":81,"product_name":82,"url":83,"description":84},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"slug":102,"name":103,"problem":104,"products":105},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":146},"clickfix-abuses-polygon-blockchain-to-hide-c2-infrastructure-across-31-orgs","ClickFix Abuses Polygon Blockchain to Hide C2 Infrastructure Across 31 Orgs","The ClickFix campaign exploited the immutable and decentralized nature of the Polygon blockchain to store and rotate command-and-control server addresses using a technique called EtherHiding. Because blockchain transactions cannot be deleted or easily blocked at the source, traditional domain takedown and IP blacklisting defenses are rendered largely ineffective. This represents a significant evolution in attacker tradecraft, where legitimate public infrastructure is weaponized to evade detection and disruption. Organizations that rely solely on static threat intelligence feeds or domain-based blocking failed to detect or intercept the malicious traffic. The campaign's success across 31 organizations underscores a dangerous gap in awareness of emerging evasion techniques and the monitoring of outbound traffic to blockchain RPC endpoints.",[136,137,138,139,140,141,142,143,144,145],"CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","CIS Control 10: Malware Defenses","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF DE.CM-1: Network Monitoring","MITRE ATT&CK T1102: Web Service (C2 via legitimate web services)","MITRE ATT&CK T1071: Application Layer Protocol","MITRE ATT&CK T1204: User Execution (ClickFix social engineering lure)",{}]