EtherHiding ClickFix on Polygon

Summary

GuidePoint Security published this analysis on 17 September 2026. A smart contract found during a business email compromise investigation led its researchers to an operation active since at least November 2025 that keeps its C2 addresses on the Polygon blockchain. Script injected into at least 31 hacked business websites waits for visitors arriving from Bing or Google, gates them through a traffic-distribution layer, then shows a fake CAPTCHA asking them to paste a command into the Run dialog. That command registers a scheduled task that retries every minute until a dropper arrives from a per-visit delivery domain; the dropper installs a Run-key persistence script and a PowerShell backdoor that asks a Polygon contract for its current C2. GuidePoint then watched the backdoor install a repackaged screen recorder and a browser extension acting as a banking trojan against about 479 financial and crypto domains.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

2 of 31

Checks recorded

2

Checks since publication

2

Never checked

29

Observation window 2026-10-11 to 2026-10-11. Checks are sampled, not continuous; the sampling policy is on /methodology. 29 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 3 of these mechanisms appear together in 15 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

31 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.