Criminals Hid a Hacking Network Inside a Cryptocurrency Blockchain. Thirty-One Companies Got Caught.
A new campaign turns blockchain technology into an untraceable instruction relay, letting attackers redirect infected computers to a new server for less than a penny per update.
Key points
- Criminals broke into the websites of at least 31 organisations across e-commerce, professional services, and retail logistics, according to a GuidePoint Security report published this week.
- The attackers used a technique called EtherHiding, which hides criminal instructions inside the Polygon cryptocurrency blockchain, making it far harder to cut off infected machines than in a typical attack.
- Redirecting every infected computer to a new criminal server costs the attacker fractions of a cent per update, using Polygon's blockchain ledger.
- The campaign uses ClickFix, a trick that fools people into running malicious software against themselves by following fake on-screen instructions.
- GuidePoint's researchers stumbled on the infrastructure while investigating what they initially thought was a straightforward email-fraud case.
A criminal campaign detailed by GuidePoint Security has broken into the websites of at least 31 organisations and quietly turned the Polygon blockchain into a private, nearly unjammable communications network for malware. Nobody has yet publicly claimed responsibility. GuidePoint's researchers, first reported by Dark Reading, describe the group as likely being an initial access broker, meaning a specialist criminal who breaks into networks and then sells that access to other criminals rather than running ransom or fraud schemes directly.
How does hiding instructions in a blockchain actually work?
Normally, malicious software phones home to a fixed criminal server. Block that address and the malware goes silent. This campaign does something cleverer.
The Polygon blockchain is a permanent, public, tamper-proof digital ledger, the same kind of record-keeping system that underpins cryptocurrencies. The attackers store their current server address inside it. When the malware needs new instructions, it reads the blockchain like a noticeboard. If investigators or security teams block the criminal server, the attacker simply writes a new address to the blockchain, and every infected machine updates automatically. Cost per update: a fraction of a cent.
"For fractions of a cent per transaction, the attacker can redirect every infected machine to a new C2 server automatically," wrote Jean-Pierre Mouton, senior threat intelligence consultant at GuidePoint, in the report. A C2 server, short for command-and-control server, is the machine criminals use to send instructions to software they have planted on victims' computers.
The malware also survives reboots and checks in with its criminal server every minute.
How did ordinary people end up infected?
The entry point was a trick called ClickFix. Researchers at Proofpoint first spotted ClickFix roughly two years ago. It works by showing a fake "Human Verification" pop-up on a website, the kind of "prove you're not a robot" box that has become routine online. The fake version instructs the visitor to press Windows and R simultaneously (which opens a hidden run prompt on Windows computers), then paste something in and press Enter. That "something" is malicious code the website has already loaded into the visitor's clipboard without them noticing.
The compromised sites themselves were legitimate businesses whose websites the attackers had already quietly altered, typically by exploiting a security flaw in WordPress or a similar website-building platform. Visitors to those sites had no obvious reason for suspicion.
| Stage | What happened |
|---|---|
| Site compromise | Attackers planted hidden code in legitimate business websites |
| Lure delivery | Visitors saw a fake verification pop-up and followed its instructions |
| Malware installed | A dropper program, which installs further malicious tools, ran on the visitor's machine |
| Blockchain check-in | Malware read the Polygon ledger for the current criminal server address |
| Persistence | Software survived reboots and checked in every 60 seconds |
Mouton's team only found the infrastructure by accident. They were called in to investigate what looked like a business email fraud case, found an unusual script that was reaching out to the Polygon blockchain, and pulled on that thread until the full picture emerged.
Should people who visited affected sites be worried?
Potentially yes, if they followed the fake verification instructions. The malware installs quietly, leaves no obvious sign, and keeps running after the computer restarts.
Anyone who recently visited an unfamiliar site, saw an unusual verification box, and followed instructions involving keyboard shortcuts should run a full scan with up-to-date security software and tell their IT team immediately. Employees should also report any strange pop-ups they clicked through on work computers, even if nothing seemed to go wrong at the time.
For organisations, Mouton recommends blocking access to blockchain network endpoints from company computers, since almost no normal office work requires querying a cryptocurrency ledger. Enabling detailed logging of PowerShell, the Windows scripting tool the malware uses, and setting alerts for unusual script activity would also help catch this kind of attack early.
