Posted on

ClickFix EtherHiding Campaign – Polygon Blockchain C2 and Persistent Backdoor

Threat Overview

GuidePoint Security reported on September 1, 2026 that a ClickFix campaign compromised at least 31 legitimate websites across e-commerce, professional services, and retail logistics. Visitors arriving from search engines can receive a fake human-verification overlay instructing them to press Windows+R, paste a command, and execute it.

The installed backdoor uses Polygon blockchain smart contracts as an attacker-controlled address book. Malware queries Polygon RPC infrastructure to retrieve its current command-and-control destination, allowing operators to rotate C2 without modifying the malware. GuidePoint reports persistence across reboots and one-minute beaconing. Durable indicators include the PersonalizedUpdates Run-key value, scheduled task Enter, extension ID bpknfkhjjbjgagobdaekmnlgdhbbpcea, and native messaging host com.top.index.

References

Impacted Systems

  • Windows endpoints reached through compromised websites.
  • Initial execution uses fake CAPTCHA/human-verification prompts and Windows+R.
  • At least 31 organizations’ websites were compromised at publication time.
  • C2 discovery uses Polygon blockchain smart contracts and public RPC infrastructure.
  • Persistence includes PersonalizedUpdates and scheduled task Enter.
  • Attacker prerequisite: the user follows the ClickFix prompt and executes the supplied command.

Why this matters

The campaign combines a common user-execution technique with durable persistence and dynamically rotatable blockchain-based C2. Static domain blocking alone is insufficient, making behavioral endpoint hunting especially important.

Exploitation Status

Confirmed malicious campaign. GuidePoint based its findings on incident-response evidence, blockchain forensics, and recovered malware source code.

What this hunt looks for

ClickFix PowerShell execution, published campaign domains, Polygon RPC access from unexpected processes, Run-key and scheduled-task persistence, the malicious browser extension ID, published hashes, and browser-to-shell execution.

Required logs

  • DeviceProcessEvents
  • DeviceNetworkEvents
  • DeviceRegistryEvents
  • DeviceFileEvents
  • SecurityEvent Event ID 4688 fallback

Hunt 1 – First-Pass: ClickFix PowerShell Self-Execution

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("Invoke-RestMethod"," irm ","AddScript(","System.Management.Automation.PowerShell","-replace 1 -split 2")
| where ProcessCommandLine has_any ("http://","https://",".fun/",".online/",".xyz/",".top/")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 2 – Published EtherHiding Domains

let CampaignDomains = dynamic(["3262d48df5d75e34.shop","ddcd62e16a428c8e.shop","hivinest.online","45a3158594d6ba76.fun","82d35f9b891c987a.fun","9082b2a18f2e00fe.fun","67b3ac3e45812153.fun","folfdighdd.xyz","cleearpeyak.online","onemm.net","additionalver.com","promo-chatgpt.com","pleasewaitcenter.top","skaybolt.online","lanhd6549tdhse.top","purplepencel.online","detsigen.site"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteUrl in~ (CampaignDomains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| sort by TimeGenerated asc

Hunt 3 – Polygon RPC Access From PowerShell

let PolygonRPC = dynamic(["polygon-bor-rpc.publicnode.com","polygon.publicnode.com","polygon.gateway.tenderly.co","gateway.tenderly.co","1rpc.io","polygon.api.onfinality.io","polygon.rpc.subquery.network","polygon.drpc.org","polygon.lava.build"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteUrl in~ (PolygonRPC)
| where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe") or InitiatingProcessCommandLine has_any ("powershell","AddScript","Invoke-RestMethod"," irm ")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| sort by TimeGenerated asc

Hunt 4 – PersonalizedUpdates Run-Key Persistence

DeviceRegistryEvents
| where TimeGenerated >= ago(30d)
| where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Run"
| where RegistryValueName =~ "PersonalizedUpdates"
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 5 – Scheduled Task Enter

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has "Enter"
| where ProcessCommandLine has_any ("/Create","/SC MINUTE","/MO 1")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 6 – Malicious Browser Extension ID

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath has_any (@"\Google\Chrome\User Data\",@"\Microsoft\Edge\User Data\")
| where FolderPath has @"\Extensions\bpknfkhjjbjgagobdaekmnlgdhbbpcea\"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 7 – Browser-to-PowerShell Execution

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe")
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 8 – SecurityEvent 4688 Fallback

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where NewProcessName endswith @"\powershell.exe" or NewProcessName endswith @"\pwsh.exe"
| where CommandLine has_any ("Invoke-RestMethod"," irm ","AddScript(","System.Management.Automation.PowerShell","-replace 1 -split 2")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| sort by TimeGenerated asc

Detection Notes

  • Highest-signal host indicators are PersonalizedUpdates, scheduled task Enter, and the published extension ID.
  • The campaign rotates C2 through Polygon, so a single blocked domain or IP is not durable.
  • Polygon RPC traffic can be legitimate; process and user context matter.
  • ClickFix command syntax can change. Browser-to-shell execution and persistence are more durable signals.
  • SecurityEvent fallback requires Event ID 4688 with command-line auditing.
  • Missing DeviceRegistryEvents or DeviceFileEvents removes some of the strongest detections.

Leave a comment