Analysis of blockchain malware delivery techniques
The Cribl SecOps team (Alpine) identified and investigated an active ClickFix malware campaign leveraging a novel technique known as EtherHiding using the Polygon blockchain to obfuscate and dynamically rotate command-and-control (C2) infrastructure.
A compromised WordPress site was found serving a malicious script embedded in its robots.txt file. When visited, the script queries the Polygon blockchain via public RPC endpoints, calling a smart contract to retrieve an encoded second-stage C2 domain. By storing malicious domains in blockchain transaction data rather than traditional infrastructure, the attacker gains a resilient, censorship-resistant delivery mechanism that is difficult to detect and block through conventional means.
Analysis of the smart contract revealed 11 domain-rotation transactions tied to a single smart contract creator, which was linked to 26 total transactions across 4 unique contracts, all using the same technique. The threat actor's wallet was funded through the FixedFloat cryptocurrency exchange.
The Alpine team leveraged Cribl Search and Push Security to perform triage and investigation. Detection opportunities, indicators of compromise, and hunting queries are included in this report.
Investigation trigger
The Cribl Alpine team were alerted to a potential ClickFix attack by Push Security1. Upon triage of the alert, it was apparent that the site was benign in intent but had been compromised due to a weakness in WordPress, allowing a malicious actor to embed a malicious script in the robots.txt file of the site2.
1 - Initial Push Security alert
2 - robots.txt contents containing malicious script
When any user now visits the site, this script executes and calls out to domains for the next stage of the attack campaign.
The initially compromised domain has been redacted, to protect them. We reached out and they are mitigating the issue.
Script analysis
The script was exported from our sandbox environment and deobfuscated in Cyberchef. The following recipe was constructed:
From_Base64('A-Za-z0-9+/=',true,false)
Remove_null_bytes()
XOR({'option':'Hex','string':'2E'},'Standard',false)
Generic_Code_Beautify()
The initial takeaway was that there were multiple Polygon endpoints referenced in the malicious code:
polygon-publicnodies[.]app
polygongatewaytenderly[.]co
rpcankr[.]com/polygon
1rpc[.]io/matic
rpc-mainnetmaticquiknode[.]pro
polygondrpc[.]org
polygon-mainnetpublicblastapi[.]io
polygon-bor-rpcpublicnode[.]com
Polygon is a technology to enable lower cost Ethereum blockchain transactions, via an RPC endpoint. As above, these are the RPC endpoints you can call to fetch transaction information and initiate transactions.
3 - Polygon endpoints in malicious code
Underneath the domains, we identified two variables of interest:
var _cuwtzb = "0x0C7Cb01C83203aC0a50Abc3a9AFF3c9Ca727eF55";
var _zmkzgh = "b68d1809";
These values were found in the sandbox telemetry being utilized in the HTTP requests3 to polygon.gateway.tenderly[.]co
4 - Variables found in code are located in HTTP telemetry
In short, the script is constructing and executing a JSON-RPC eth-call wrapped in a HTTP request to polygon.gateway.tenderly[.]co/ (Polygon RPC endpoint) with the following headers set:
Id:1
Jsonrpc:2
Method:eth_call
ParamsData:0xb68d1809
ParamsTo:0x0C7Cb01C83203aC0a50Abc3a9AFF3c9Ca727eF55
Params:latest
This returns encoded information found in the response body, specifically in the “Result” header:
0x0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001768747470733a2f2f7468752d697061642d30332e636664000000000000000000
This decodes to: https[://]thu-ipad-03[.]cfd, a known-malicious site via many intelligence sources, including VirusTotal - Domain - thu-ipad-03.cfd and ThreatFox | thu-ipad-03.cfd, reported as “ClickFix”.
5 - Decoded response variable containing malicious domain attributed to ClickFix
Once retrieved the script sends a HTTP request5 to this second-stage domain with an identifier set, this seems to be specific to the original site rather than the victim host, therefore it’s assessed as static until otherwise changed by the attacker.
The purpose of this request is likely to download a second-stage or render a ClickFix panel.
6 - Decoded response variable containing malicious domain attributed to ClickFix
In summary, the script flows as such:
Prevents itself from running more than once on the same host by checking for a global flag.
Stores an identifier in the ‘rgadh’ variable, which is also sent later to the second-stage server thu-ipad-03[.]cfd. Using a parameter ‘s=’.
Utilizes multiple fallback Polygon RPC endpoints to ensure success.
Specifies a Polygon smart contract.
Performs an Ethereum-compatible contract call (eth-call via JSON RPC).
Extracts and decodes the string in the resulting response from the contract.
Dynamically calls the second-stage server with the ‘s=’ parameter to execute the next stage.
Blockchain smart contract analysis
Polygonscan is a website that allows you to explore Polygon blockchain for transactions, addresses, tokens and prices. Utilizing that site enables us to look up the contract ID and associated transaction history.
Address: 0x0C7Cb01C...Ca727eF55 | PolygonScan
7 - The associated contract and transaction history
This contract (0x0C7Cb01C83203aC0a50Abc3a9AFF3c9Ca727eF55) was created 42 days ago from the time of writing this (08/11/2026) by 0x2f9091ab4ec91c0daa67a7660c81a922328a8096. When analyzing the transactions, the technique becomes apparent.
The transaction contains a field called “Input Data” which is described as:
Additional data included for this transaction. Commonly used as part of contract interaction or as a message sent to the recipient.
The input data field7 contains our encoded domain which can be decoded on Polygonscans own tools:
8 - Input Data field containing encoded data
9 - Decoded Input Data containing the second-stage domain
When analyzing all 11 transactions, all have an action of “Update Domain”, this action is used to rotate their second-stage infrastructure on the blockchain. We uncovered the following domains from all of the other transactions:
When pivoting to the contract creator ID: 0x2f9091ab4ec91c0daa67a7660c81a922328a8096, we were able to follow the trail and uncover a total of 26 transactions across 4 unique contracts, all displaying the same use of the Input Data field in the transaction history. A CSV has been attached to this report pack.
This address is seen to be funded by “FixedFloat 3”, one of many wallets ran by the upstream ††cryptocurrency exchange, FixedFloat.
10 - Contract Creator address, showing 26 total transactions.
Indicators of compromise
Please note this is not an exhaustive list and we are only including IOCs we have observed.
Additional detection opportunities
PowerShell Hidden Window Execution
AND when vendor == "Windows"
AND when event_type == "process creation"
AND when process_name IN ("powershell.exe", "pwsh.exe")
AND when command matches regex "(?i)[-\/]\^?w(?:\^?i(?:\^?n(?:\^?d(?:\^?o(?:\^?w(?:\^?s(?:\^?t(?:\^?y(?:\^?l(?:\^?e)?)?)?)?)?)?)?)?)?)?[ \t:=\^]+["'`]*(?:\^?h(?:\^?i(?:\^?d(?:\^?d(?:\^?e(?:\^?n)?)?)?)?)?|\^?0*\^?1)\b"
DNS traffic to known-RPC endpoints from unusual endpoints
AND when event_type == "DNS Traffic"
AND when domain_name IN ("api.mainnet-beta.solana.com", "go.getblock.us", "api.blockeden.xyz", "solana.api.pocket.network", "ethereum.org", "infura.io", "alchemy.com", "alchemyapi.io", "ankr.com", "ankr-rpc.com", "quiknode.pro", "quiknode.com", "quicknode.com", "tatum.io", "thirdweb.com", "tenderly.co", "flashbots.net", "mevblocker.io", "drpc.org", "blockpi.network", "llamarpc.com", "1rpc.io", "0xrpc.io", "nodies.app", "blastapi.io", "nownodes.io", "pokt.network", "pokt.io", "merkle.io", "blinklabs.xyz", "leorpc.com", "publicnode.com", "cloudflare-eth.com", "payload.de", "etherscan.io", "ethplorer.io", "blockchair.com", "getblock.io", "chainstack.com", "moralis.io", "figment.io", "nodesmith.io", "blockdaemon.com", "onfinality.io", "hardhat.org", "paradigm.xyz", "ethrpc.com", "web3api.com", "icp0.io", "binplorer.com", "bscscan.com", "bnbchain.org", "polygon-rpc.com", "polygonscan.com", "blockchain.info", "blockchain.com", "blockstream.info", "mempool.space", "blockcypher.com", "trongrid.io", "tronscan.org", "binance.org", "ninicoin.io", "defibit.io", "dht.libtorrent.org", "router.bittorrent.com", "router.utorrent.com", "polygon-publicnodies.app", "polygongatewaytenderly.co", "rpcankr.com/polygon", "1rpc.io", "rpc-mainnetmaticquiknode.pro", "polygondrpc.org", "polygon-mainnetpublicblastapi.io", "polygon-bor-rpcpublicnode.co")
DNS traffic to unusual TLDs
AND when event_type == "DNS Traffic"
AND when domain_name mathces regex "\.(pro|cc|cfg)$"
