Polygon Blockchain Used to Hide Malware Infrastructure

Hackers are using the Polygon blockchain to hide parts of their malware operation out of sight. The campaign, tracked as ErrTraffic, turns hacked WordPress sites into launch points for fake verification prompts that persuade visitors to run harmful Windows commands.

The trick is known as ClickFix, where a page tells a visitor to copy and paste a supposed fix, often into the Windows Run box or PowerShell. This single action can download a payload, giving criminals access to browser data, saved credentials, cookies, and cryptocurrency-wallet information.

WatchGuard analysts identified the activity in telemetry and linked it to an ErrTraffic malware-as-a-service operation advertised by a forum user known as LenAI. The findings show one delivery service distributing several threats, including Vidar, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader.