Cybercriminals are increasingly leveraging the Polygon blockchain to obscure their malware operations, employing sophisticated social engineering techniques to deceive users into executing malicious commands. This campaign, identified as ErrTraffic, transforms compromised WordPress sites into platforms that display fake verification prompts, coercing visitors to run harmful Windows commands.
The method, known as ClickFix, doesn’t exploit software vulnerabilities directly. Instead, it manipulates users into copying and pasting seemingly benign commands—often into the Windows Run dialog or PowerShell—which then download and execute malicious payloads. These payloads can grant attackers access to sensitive information, including browser data, saved credentials, cookies, and cryptocurrency wallet details.
Security analysts have traced this activity to the ErrTraffic malware-as-a-service operation, advertised by an individual known as LenAI on underground forums. This service distributes various threats, such as Vidar, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, indicating a broad and adaptable attack infrastructure.
Blockchain-Based Infrastructure Enhances Evasion
The ErrTraffic campaign initiates when a user visits a compromised WordPress website. The injected JavaScript doesn’t contain the final malicious destination in clear text. Instead, it queries the Polygon blockchain via remote procedure call (RPC) services to retrieve configuration data from a smart contract. This data directs the user to the current attacker-controlled infrastructure.
This technique, often referred to as EtherHiding, complicates takedown efforts. Operators can update the information within the smart contract without modifying every infected website, allowing for rapid changes to the attack infrastructure. This approach mirrors tactics seen in previous WordPress traffic broker campaigns, where attackers dynamically adjust their delivery mechanisms to evade detection.
Deceptive Prompts Lead to Multiple Payloads
Once the user reaches the malicious site, they encounter a fake browser or CAPTCHA-style verification prompt. This prompt instructs them to execute a PowerShell command, which can download both a randomly named 7-Zip program and a malicious payload, or fetch the payload directly. By following these instructions, the victim inadvertently initiates the malware execution.
The campaign’s adaptability is evident in its use of multiple payloads. For instance, Vidar targets browser and wallet data and has been observed communicating through platforms like Telegram and Steam. Some variants create remote threads in browsers like Chrome and Edge, potentially exposing sensitive information stored within these applications.
Other payloads, such as Okobot, arrive via ZIP archives containing malicious DLLs. These variants attempt to disable Microsoft Defender settings and remove protections around LSASS, a Windows process that stores sensitive login credentials. This pattern aligns with recent ClickFix MSI delivery attacks, where deceptive prompts lead users to execute malware.
Additional findings include malicious MSI files with Node.js backdoors utilizing Tor for command-and-control communication, as well as OnionDrop variants that employ DLL side-loading to conceal their presence. Some Go-based variants connect to infrastructure associated with LegionLoader, while others use Windows compilation tools to deploy BabaDedaLoader payloads.
For defenders, the primary challenge is preventing these deceptive prompts from leading to malware execution. Users should be educated to never paste commands from unverified sources, such as CAPTCHA prompts, update notices, or support pages, into their systems. Implementing robust security measures and maintaining user awareness are crucial in mitigating the risks posed by such sophisticated attack campaigns.
This development underscores the evolving nature of cyber threats, where attackers combine blockchain technology with social engineering to create resilient and elusive malware infrastructures. As these tactics become more prevalent, both users and organizations must remain vigilant and proactive in their cybersecurity practices.
