Cybersecurity researchers have uncovered a malware campaign that uses the Polygon blockchain to conceal parts of its infrastructure, allowing attackers to make their delivery network more difficult to disrupt.
The campaign, tracked as ErrTraffic, compromises WordPress websites and turns them into launch points for fake verification pages. Visitors are presented with prompts resembling browser checks or CAPTCHA procedures and are persuaded to execute Windows commands themselves. The technique, known as ClickFix, relies on social engineering rather than exploiting a software vulnerability.
Once a victim follows the instructions and runs the command, malware can be downloaded onto the system. Depending on the payload, attackers may gain access to browser information, stored credentials, cookies, and cryptocurrency wallet data.
WatchGuard analysts identified the activity through their telemetry and connected it to an ErrTraffic malware-as-a-service operation promoted by a forum user operating under the name LenAI. The infrastructure was found to distribute several malware families, including Vidar, Okobot, LegionLoader, OnionDrop-related payloads and BabaDedaLoader.
The campaign combines a convincing user interaction with blockchain-backed infrastructure, allowing attackers to change delivery details without modifying every compromised website.
Polygon Smart Contracts Help Conceal Infrastructure
The campaign begins when a visitor accesses an infected WordPress website. Malicious JavaScript injected into the page does not openly reveal the attacker’s final destination. Instead, it communicates with Polygon through remote procedure call services and retrieves configuration information stored in a smart contract.
That information is then used to identify the current attacker-controlled infrastructure. The technique, commonly referred to as EtherHiding, can complicate takedown efforts because attackers can modify information stored in the blockchain without having to update the malicious code placed on every infected website.
The infrastructure also incorporates traffic routing and location-based filtering, giving operators greater flexibility in deciding which visitors receive the malicious content. The resulting setup can allow different affiliates or operators to change delivery paths while maintaining the same basic social-engineering strategy.
The final PowerShell command may download a randomly named 7-Zip executable together with a similarly randomized payload or retrieve the malicious payload directly. This approach makes the victim responsible for the execution step while the attacker avoids relying solely on traditional software vulnerabilities.
Multiple Malware Families Increase the Risk
The range of malware delivered through the campaign adds to the threat. Vidar, for example, can target browser and cryptocurrency wallet information. Researchers observed versions communicating through services including Telegram, Steam and a compromised Brazilian website.
Another Vidar variant was observed creating remote threads inside Chrome and Edge processes, potentially allowing attackers to access information maintained by those browsers.
Okobot was also identified in the campaign. It arrived through a ZIP archive containing a file named Volume2 and a malicious DLL. Researchers found that the malware attempted to weaken Microsoft Defender protections and interfere with security mechanisms surrounding LSASS, a Windows process that manages sensitive authentication information.
Other components included a malicious MSI package containing a Node.js backdoor that used Tor for command-and-control communications. Researchers also identified OnionDrop variants that used DLL side-loading to conceal malicious activity behind legitimate applications.
Additional infection chains were associated with LegionLoader and BabaDedaLoader, demonstrating that the infrastructure could support multiple malware families rather than a single threat.
Defenders Urged to Monitor the Entire Attack Chain
Security teams should focus on preventing fake verification prompts from becoming execution points and should investigate suspicious PowerShell activity, browser process injection, and unusual downloads following visits to compromised websites.
Organizations can also look for WordPress sites that create the errtraffic_session cookie and examine network connections to Polygon RPC services that occur immediately after visits to suspicious pages. Newly created DLL files and unexpected downloads can provide additional indicators of compromise.
Keeping WordPress installations, plugins, and themes updated, while removing injected scripts, can reduce the number of websites available to attackers.
The campaign highlights a broader shift in cybercrime tactics in which legitimate technologies are repurposed to conceal malicious operations. Blockchain infrastructure, Windows utilities, browser processes, and trusted websites can each serve a limited function within an attack, but their combination can make the overall operation harder to identify and disrupt.
Monitoring the complete infection chain instead of focusing on a single malware family could give organizations a better chance of detecting future variations of the ErrTraffic campaign.
