ErrTraffic ClickFix Malware Uses Polygon Blockchain for Evasion

ErrTraffic ClickFix Malware: WordPress Sites Used for Blockchain-Enabled Attacks

ErrTraffic ClickFix malware is a sophisticated threat campaign that leverages compromised WordPress sites and the Polygon blockchain to deliver malicious payloads to Windows and, in some cases, macOS users. The attackers employ a deceptive technique known as ClickFix, which exploits user trust rather than technical vulnerabilities, leading to credential and cryptocurrency theft on a wide scale.

How the ErrTraffic ClickFix Attack Works

Initial Compromise and Lure Delivery

The operation begins when legitimate WordPress websites are breached, often through injected obfuscated JavaScript or persistent backdoors such as WordPress mu-plugins. Once a user visits a compromised site, the injected script decodes itself and initiates a unique blockchain-based infrastructure lookup. Specifically, it sends a read-only eth_call request to a smart contract on the Polygon blockchain. That smart contract returns the current command-and-control (C2) server, which the script uses to fetch additional malicious code.

Fake Verification Overlays and User Coercion

The compromised site then displays a convincing fake Cloudflare or CAPTCHA verification overlay. This overlay is localised for the visitor and includes precise instructions: the user is told to open an elevated Windows Terminal using Win+X plus a keyboard shortcut (such as ‘I’), then paste a command that has already been copied to the clipboard. This is the core of the ClickFix technique. The overlay assures the user this step is needed to verify their visit or resolve an error, preying on non-technical users’ desire to comply and gain access.

Malicious Command Execution and Payload Delivery

• The command pasted by the user is an encrypted PowerShell (or in some cases, macOS terminal) instruction.
• This command forces TLS 1.2, creates a randomly named directory under %LOCALAPPDATA%\Temp\<random>\, and downloads the next stage payload from the C2 domain resolved via the Polygon contract.
• Subsequent stages include infostealers (Vidar, Okobot), loaders (LegionLoader, BabaDedaLoader), and other malware families. These payloads harvest browser credentials, cookies, and cryptocurrency wallet information.

Blockchain-Based Evasion: EtherHiding

One of the most innovative aspects of ErrTraffic ClickFix is its use of the EtherHiding technique. Rather than hardcoding C2 domains, attackers store or rotate these domains via a Polygon smart contract. This dead-drop resolver means that even if a compromised site is cleaned, the infrastructure can quickly redirect to new C2s. Whalebone telemetry in March to May 2026 documented 59 unique C2 domains rotated roughly every 22 hours through a single Polygon contract: 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308.

Operational Details, Timeline and Infrastructure

ErrTraffic Campaign Clusters and Cybercrime-as-a-Service

Researchers have identified two key operational clusters:

• Analytics cluster: Uses a single Polygon contract to resolve its C2 and delivers the lure from /cf.js.
• Beer cluster: Employs distinctive API endpoints such as /api/css.js and /api/index.php, sometimes returning RC4-encrypted PowerShell code.

The campaign is marketed as malware-as-a-service on underground forums by a seller known as LenAI. As early as December 2025, the ErrTraffic panel was advertised for around 800 USD, offering affiliates a turnkey system for running ClickFix campaigns. Reports indicate high ‘conversion’ rates, as users often comply with the lure’s instructions.

Timeline of Activity

• December 2025: ErrTraffic appears for sale on cybercrime forums.
• April 2026: LevelBlue SpiderLabs details the use of EtherHiding with ClickFix in ErrTraffic v3.
• March–May 2026: Whalebone observes live domain rotation and details the lure’s clipboard-based attack flow.
• July 2026: Public malware sandboxes record active ClickFix infrastructure tied to domains such as authorization-cdn-press-enter[.]info.
• August 2026: Media coverage links ongoing activity and payload variety to ErrTraffic.

Affected Products and Victim Profile

• Websites: WordPress installations, particularly those with weak admin controls, are compromised to inject the malware loader scripts.
• Endpoints: Windows users are the primary targets, but some campaigns also deliver macOS-specific payloads via adapted terminal instructions.
• Data at risk: Browser-saved credentials, cookies, and cryptocurrency wallet data are targeted by delivered stealer and loader payloads.

Current Exploitation Status

• The campaign is ongoing and active, with live infrastructure and victim infections confirmed by vendor telemetry, public sandboxes, and threat intelligence feeds.
• The operation rotates infrastructure frequently—Whalebone tracked 59 C2 domains in two months—making blocklist-based defences difficult.
• Payload families change depending on affiliate, but commonly include Vidar, Okobot, LegionLoader, OnionDrop and BabaDedaLoader.

Detection, Indicators and Guidance

Indicators of Compromise (IOCs)

• Domains: Example—authorization-cdn-press-enter[.]info
• File hashes:
  • SHA256: 5BA78FF78F0DE35E8A8943051BD0AED7A4748B83B52ED659C912F3843BD043BE
  • SHA1: 92F49753B48BED2FEE44B759639DF87A902B4792
  • MD5: 5F1A4AB63B6180EA51BA97A630B6C2B7
• File paths: Look for random directories under %LOCALAPPDATA%\Temp\
• API endpoints: /cf.js, /api/css.js, /api/index.php with parameters such as a=ctx, mode=download, src=cloudflare
• Polygon contract: 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308

Vendor and Official Guidance

• Microsoft: Recommends blocking suspicious process chains from user-launched terminals, monitoring clipboard activity from web content, and user education—no legitimate verification process requires opening a terminal and pasting commands.
• Security vendors (e.g. LevelBlue, Whalebone, Sekoia): Suggest removal of unauthorised plugins, monitoring for blockchain RPC access patterns, and detection based on terminal invocation after visiting unknown sites.

Why This Matters and What to Do

The ErrTraffic ClickFix campaign demonstrates how attackers can bypass traditional technical controls by targeting user behaviour and leveraging resilient blockchain infrastructure. The use of Polygon smart contracts for C2 rotation makes takedown efforts challenging, and the clipboard-based lure is highly effective against less technical staff.

• SMBs running WordPress and Windows should audit their web admin panels, remove unauthorised code, and block access to known ClickFix endpoints.
• Train users to recognise that no genuine website will ask them to open Windows Terminal or PowerShell and paste commands for verification.

Originally reported by cybersecuritynews.com.