In a sophisticated cyber campaign, hackers have leveraged the Polygon blockchain to conceal components of a malware operation known as ErrTraffic. This campaign turns compromised WordPress websites into portals that present fake verification prompts, tricking users into executing malicious Windows commands.
Understanding the ClickFix Technique
The ClickFix method employed by these hackers does not rely on software vulnerabilities. Instead, it deceives users by asking them to copy and paste a ‘fix’ into the Windows Run box or PowerShell. This simple action can result in the download of a malicious payload, granting attackers access to browser data, stored credentials, cookies, and cryptocurrency wallet information.
According to WatchGuard analysts, this activity is linked to a malware-as-a-service operation called ErrTraffic, advertised by a user known as LenAI. The campaign demonstrates how a single delivery service can distribute multiple threats, including Vidar, Okobot, LegionLoader, OnionDrop, and BabaDedaLoader.
Innovative Use of Blockchain for Concealment
The use of the Polygon blockchain as a concealment tool is a notable aspect of this operation. Once a user lands on a compromised website, the injected JavaScript does not reveal the attack’s final destination. Instead, it uses remote procedure calls to query the blockchain, retrieve a smart contract configuration, and identify the current attacker-controlled infrastructure.
This technique, referred to as EtherHiding, makes it difficult to dismantle the operation because attackers can update the smart contract information without needing to alter each infected site. This method allows them to rotate infrastructure rapidly, evading detection.
Implications for Cybersecurity Defenses
The ErrTraffic campaign highlights significant concerns for cybersecurity defenses. The payloads deployed, such as Vidar, target browser and wallet data, utilizing communication channels like Telegram and compromised websites. Additionally, Okobot infections attempt to weaken Microsoft Defender and exploit Windows processes to compromise sensitive information.
To counter these threats, security teams must focus on preventing user prompts from leading to malware execution. This involves educating users to avoid pasting commands from suspicious prompts and ensuring that network activity involving Polygon RPC services is closely monitored. Regular inspection of WordPress sites for unexpected cookies and PowerShell downloads is also crucial.
In conclusion, this exploit underscores the need for vigilance in monitoring blockchain platforms and familiar systems that can be repurposed for malicious activities. By understanding the full chain of such operations, organizations can improve their chances of detecting and mitigating future variations.
