Criminals Hid a Hacking Network Inside a Cryptocurrency Blockchain. Thirty-One Companies Got Caught.

Key points

• Criminals broke into the websites of at least 31 organisations across e-commerce, professional services, and retail logistics, according to a GuidePoint Security report published this week.
• The attackers used a technique called EtherHiding, which hides criminal instructions inside the Polygon cryptocurrency blockchain, making it far harder to cut off infected machines than in a typical attack.
• Redirecting every infected computer to a new criminal server costs the attacker fractions of a cent per update, using Polygon's blockchain ledger.
• The campaign uses ClickFix, a trick that fools people into running malicious software against themselves by following fake on-screen instructions.
• GuidePoint's researchers found the infrastructure by accident, while investigating what they initially thought was a business email fraud case.

A criminal campaign detailed by GuidePoint Security has broken into the websites of at least 31 organisations and quietly turned the Polygon blockchain into a private, nearly unjammable communications network for malware. Nobody has publicly claimed responsibility. GuidePoint's researchers, first reported by Dark Reading, describe the group as likely being an initial access broker, meaning a specialist criminal who breaks into networks and sells that access to other criminals rather than running ransom or fraud schemes directly.

How does hiding instructions in a blockchain actually work?

Normally, malicious software phones home to a fixed criminal server. Block that address and the malware goes silent. This campaign does something cleverer.

Polygon is a permanent, public, tamper-proof digital ledger, the same kind of record-keeping system that underpins cryptocurrencies. Rather than embed a fixed server address in the malware, the attackers store their current server address inside Polygon's ledger. When the malware needs new instructions, it reads the blockchain like a noticeboard. Block the criminal server, and the attacker simply writes a new address to the blockchain; every infected machine updates automatically. Cost per update: a fraction of a cent.

"Because it allows for ad hoc adjustment of C2 details at scale, blocking a singular domain or IP address alone does not permanently sever attacker access," wrote Jean-Pierre Mouton, senior threat intelligence consultant at GuidePoint, in the report. A C2 server, short for command-and-control server, is the machine criminals use to send instructions to software planted on victims' computers. Mouton adds that for fractions of a cent per transaction, the attacker can redirect every infected machine to a new C2 server automatically.

Previous EtherHiding campaigns have used Binance or Ethereum blockchains. This one's use of Polygon smart contracts sets it apart.

The malware survives reboots and checks in with its criminal server every minute.

How did ordinary people end up infected?

Researchers at Proofpoint first spotted ClickFix roughly two years ago. It works by showing a fake "Human Verification" pop-up on a compromised website. The fake version instructs the visitor to press Windows and R simultaneously, which opens a hidden run prompt, then paste in pre-loaded malicious code and press Enter. The website has already loaded that code into the visitor's clipboard without them noticing. We covered the technique on 1 September in "ClickFix: The Attack That Talks You Into Hacking Yourself", after Microsoft named it the single most common way criminals broke into companies last year.

The compromised sites were legitimate businesses whose websites the attackers had quietly altered, typically by exploiting a security flaw in WordPress or a similar platform. Visitors had no obvious reason for suspicion.

Mouton's team found the infrastructure by accident. Called in to investigate what looked like a business email fraud case, they found an unusual script reaching out to the Polygon blockchain and pulled on that thread until the full picture emerged.

Should people who visited affected sites be worried?

Potentially yes, if they followed the fake verification instructions. The malware installs quietly, leaves no obvious sign, and keeps running after the computer restarts.

Anyone who recently visited an unfamiliar site, saw an unusual verification box, and followed instructions involving keyboard shortcuts should run a full scan with up-to-date security software and tell their IT team. Employees should report any strange pop-ups they clicked through on work computers, even if nothing seemed wrong at the time.

For organisations, Mouton recommends blocking access to blockchain network endpoints from company computers, since almost no normal office work requires querying a cryptocurrency ledger. Most enterprise employees have no need to query the blockchain from company-controlled endpoints, he notes, so blocking the RPC endpoints hardcoded into the malware's script would sever this strain's ability to contact its C2. Enabling detailed logging of PowerShell, the Windows scripting tool the malware uses, and setting alerts for unusual script activity would also help catch this kind of attack early.

The bigger picture here is simple: EtherHiding turns a public utility into an attacker's dead drop, and defenders have no lever to pull on the blockchain side. The only reliable answer is stopping the infection before it starts.