ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain

A sophisticated ClickFix campaign is leveraging the Polygon blockchain to dynamically update command-and-control (C2) servers, bypassing traditional blocking methods. The campaign utilizes a novel approach involving blockchain-based address book management and a dual-pronged attack – compromising websites to display a malicious JavaScript lure and then tricking users into executing the lure. Researchers believe this campaign is being conducted by an initial access broker (IAB) rather than a typical ClickFix attacker. Human-centric defenses, including advanced phishing training and blocking blockchain RPC endpoints, are recommended.

Researchers from Proofpoint first spotted ClickFix attacks about two years ago, and the technique has taken off with the cybercriminal community since then. The ultimate aim of the attack is to trick a user into executing malicious prompts against themselves.

This campaign utilizes a blockchain-based address book, where the malware can retrieve an updated C2 address without requiring the malware itself to change. Attackers use the blockchain as "an attacker-controlled address book: the malware can retrieve an updated C2 address without requiring the malware itself to change." As a result, the the backdoor's installation shows no visible indication of compromise, and the malware survives reboots, beacons to C2 every minute, and retrieves updated instructions from the Polygon blockchain.

Attackers compromise websites to display a malicious JavaScript lure, and then trick users into executing the lure. The JavaScript goes through a preliminary "gating" mechanism, which determines whether the victim gets to the next stage or not. If the victim gets through the gate, the 'Human Verification' mechanism appears as an overlay on the webpage that then produces the typical ClickFix lure, instructing the user to hit Windows+R, Ctrl+V, and then enter. This is what initiates the malware dropper and thus the subsequent payload execution.

To combat the campaign and others like it, researchers suggest introducing advanced phishing training to employees that includes the ability to recognize ClickFix and other social engineering tactics. This training should be combined with technological security measures as well, such as blocking avenues of querying any blockchain endpoints unless otherwise stated by business requirements, and implementing PowerShell logging where possible, with effective alerting to identify any potential malicious script usage. Most enterprise employees have no need to query the blockchain from company controlled endpoints.