Hackers Are Using the Polygon Blockchain to Hide Malware Infrastructure — And a Single Paste Into PowerShell Triggers It

A sophisticated malware campaign is using the Polygon blockchain to store and retrieve infrastructure configuration in a way that makes traditional takedown efforts significantly harder — while tricking victims into executing the attack themselves through a single copy-paste action. The operation, tracked as ErrTraffic and documented by WatchGuard researchers, combines compromised WordPress sites, blockchain-backed command resolution and social engineering into a delivery framework that can rotate infrastructure and swap payloads with minimal friction.

Key Points

• ErrTraffic uses compromised WordPress sites to deliver fake browser verification prompts that instruct visitors to paste malicious commands into Windows Run or PowerShell
• Infrastructure configuration is retrieved from Polygon smart contracts using EtherHiding — making takedowns difficult because attackers can update destinations without touching infected websites
• The campaign distributes multiple malware families including Vidar, Okobot, LegionLoader, OnionDrop-related payloads and BabaDedaLoader
• Vidar communicates through Telegram channels, a Steam profile and a compromised Brazilian website
• Okobot attempts to disable Microsoft Defender and remove protection around LSASS — the Windows process that holds sensitive login credentials
• The campaign is advertised as a malware-as-a-service operation by a forum user known as LenAI

How ErrTraffic Reaches Victims

The infection chain begins when a user visits a compromised WordPress website. The injected JavaScript running on that site does not contain its final destination in plain text — a deliberate design choice that helps the campaign evade static analysis and URL-based blocking.

Instead, the injected code queries the Polygon blockchain through remote procedure call services, retrieves the current attacker configuration from a smart contract and uses that response to locate the live attacker-controlled infrastructure. This approach — known as EtherHiding — means that even if individual hosting infrastructure is identified and taken down, the operators can update the smart contract with new destinations without revising a single infected website. The attack surface for defensive intervention is compressed to the blockchain layer, which defenders cannot modify.

The lure delivered to the visitor is a fake browser verification or CAPTCHA-style prompt that instructs the user to complete a supposed security check. The prompt is designed to look like a routine browser or accessibility process — the kind of interaction that millions of users complete without hesitation every day.

The ClickFix Mechanism

The critical step is what happens when the user follows the prompt's instructions. Rather than exploiting a software vulnerability, the campaign relies entirely on the victim's own action. The fake verification page instructs the visitor to copy a provided command and paste it into the Windows Run dialog or PowerShell — a technique known as ClickFix.

That single action is sufficient to initiate the infection. The pasted PowerShell command can fetch a randomly named 7-Zip archive and a randomly named payload, or download the malware directly depending on the campaign variant. The victim performs the execution step themselves — a social engineering outcome that bypasses most endpoint protections that are designed to detect software exploits rather than user-initiated command execution.

The randomised naming of both the archiver and the payload is a deliberate evasion measure. Signature-based detection that looks for known file names or hashes cannot match against names that are different in every deployment.

Multiple Payloads — Multiple Threat Profiles

What makes ErrTraffic particularly concerning beyond its delivery mechanism is the range of payloads it distributes. The framework operates as a delivery service for multiple distinct malware families, each with its own capabilities and post-infection behaviour.

Vidar is the most immediately financially damaging payload in the set. It targets browser data, saved credentials, cookies and cryptocurrency wallet information — harvesting the credentials that provide access to banking, exchange accounts and digital asset holdings. Communication channels for Vidar in this campaign include a Telegram channel, a Steam profile and a compromised Brazilian website — a combination designed to blend malicious traffic with legitimate platform communications that are difficult to block without collateral disruption. One Vidar variant created remote threads inside Chrome and Edge processes, an approach that can expose sensitive information held within active browser sessions.

Okobot arrives through a ZIP archive containing Volume2 and a malicious DLL, then moves to weaken the victim's defences before extracting credentials. Specifically, it attempts to disable Microsoft Defender settings and remove the protection around LSASS — the Windows Local Security Authority Subsystem Service, which holds authentication credentials including hashed and sometimes plaintext passwords for currently logged-in users.

Compromising LSASS is a standard step in lateral movement playbooks, giving an attacker the material needed to move from an initial foothold to broader network access.

Researchers also identified a malicious MSI package containing a Node.js backdoor that routes its command-and-control traffic through Tor, significantly complicating network-level detection. OnionDrop variants in the campaign used DLL side-loading — hiding behind legitimate Windows applications — while a Go-based variant contacted infrastructure associated with LegionLoader, and another chain used Windows compilation tools to reach a BabaDedaLoader payload.

Why the Architecture Matters

The technical design of ErrTraffic reflects the sophistication of a mature malware-as-a-service operation rather than a one-off campaign. The combination of blockchain-backed configuration storage, traffic routing through compromised WordPress sites, location-based filtering and randomised payload delivery gives the operators and their affiliates a framework that is genuinely difficult to disrupt through any single defensive action.

Takedown efforts that focus on attacker-controlled hosting infrastructure are neutralised by the EtherHiding layer — the destinations can be updated in the smart contract faster than defenders can act on each new address. URL-based blocking is defeated by the fact that the initial infection point is a legitimate WordPress site that may appear entirely normal to external scanning. Signature-based detection is defeated by randomised file naming. Behavioural detection is made harder by the fact that the execution step is performed by the user rather than by malicious software.

The framework is designed to allow affiliates to change delivery paths and payload selections while maintaining the same social engineering formula — meaning that even comprehensive documentation of one campaign variant provides limited protection against the next.

What Defenders and Users Should Do

The most effective single defensive measure against ClickFix campaigns is user awareness of a specific and simple rule: legitimate browser verification, CAPTCHA systems, update notices and support pages do not instruct users to open Windows Run, Terminal or PowerShell and paste commands. Any prompt that makes that request — regardless of how official the surrounding interface appears — is an attack.

For administrators managing WordPress installations, investigating sites that set the errtraffic_session cookie is a priority indicator of compromise. Reviewing unexpected PowerShell download activity and monitoring for suspicious browser process injection — particularly remote thread creation in Chrome or Edge — provides additional early warning signals.

Security teams should correlate network activity reaching Polygon RPC services immediately after visits to websites with unusual download activity or newly created DLLs. That correlation — between blockchain query activity and subsequent file system changes — is a more reliable indicator of ErrTraffic activity than any single file or network signature.

Keeping web applications patched and conducting regular audits for injected scripts reduces the available launch points. The broader defensive posture the campaign demands is monitoring across the full infection chain rather than focusing on any single malware name or indicator — because the framework is explicitly designed to swap components while maintaining structural continuity.

Sources

WatchGuard threat intelligence report on ErrTraffic campaign, shared with Cyber Security News, 2026. WatchGuard Secplicity blog on ErrTraffic, ClickFix and EtherHiding, 2026. Cyber Security News reporting on WordPress traffic broker campaigns, ClickFix MSI delivery attacks and malicious WordPress plugin activity. LenAI malware-as-a-service forum advertisement, referenced in WatchGuard analysis, 2026.