EtherHiding Exposed: What Security Leaders Need to Know

What’s Happening

Attackers have compromised the websites of at least 31 legitimate businesses, including e-commerce, professional services and retail logistics organizations. Visitors arriving to the compromised sites via search engine encounter a fake “Verify you’re human”. This CAPTCHA prompt instructs them to paste a command into their own computer, a tactic known as “ClickFix”. That single action installs a persistent backdoor with no visible indication of compromise. The backdoor survives reboots, beacons to C2 every minute and retrieves updated instructions from the Polygon blockchain.

What Makes This Different From Other ClickFix Campaigns

Traditionally, ClickFix malware can be neutralized by blocking the attacker’s C2 server, cutting off communications with infected machines. Many ClickFix campaigns rely on hardcoded C2 addresses, making replacement costly and time-intensive once blocked. 

This campaign sidesteps that defense by using the Polygon cryptocurrency blockchain as a dynamically updatable address book. Polygon is a permanent, distributed ledger that no single entity can take offline. Because it allows for ad hoc adjustment of C2 details at scale, blocking a singular domain or IP address alone does not permanently sever attacker access. For fractions of a cent per transaction, the attacker can redirect every infected machine to a new C2 server automatically. This tactic has been dubbed “EtherHiding,” and it allows attackers to redirect infected machines to new infrastructure at scale. 

The tactic is spreading. It was first observed in campaigns from criminal groups in 2023. North Korean state actors adopted it by late 2025 and Iran-linked groups by early 2026. The campaign documented here is part of broader proliferation into the general cybercriminal ecosystem.

What Your Organization Should Do

Immediate priorities:

• Focus on tactics, not atomic IOCs. While stationary indicators such as IP addresses are no longer effective for blocking purposes in response to this tactic, aggregate signatures can still be useful for behavioral detection. Examples include:
  • Domains clearly generated by Domain Generating Algorithms (DGAs) which are commonly flagged by threat intelligence providers
  • Repeated use of specific ASNs or IP ranges
  • Use of newly registered domains
  • Other reputation-based scoring mechanisms.

• Audit your public-facing websites continuously. If your organization runs a site on WordPress, Magento or similar platforms, hidden malicious scripts emplaced by threat actors are a live threat. Several sites in this investigation were cleaned up, then silently re-compromised weeks later. One-time checks are not sufficient.

• Restrict unapproved browser extensions via organization-level policy. Banking trojans associated with this tactic have been delivered through social engineering rather than software exploitation, resulting in malicious browser extension installation. Policies restricting unapproved browser extensions would have blocked it entirely.

• Add ClickFix to security awareness training, not just generic phishing. The initial access technique involves a fake CAPTCHA screen instructing the user to press Win+R and paste a command, a common tactic known as “ClickFix”. This tactic is now both specific enough and prolific enough to warrant inclusion in awareness training, both recurring and ad hoc. 

The Bottom Line 

In instances where the blockchain has been used to host C2 details, the resulting infrastructure address alone cannot be completely blocked or seized through conventional means. However, the blockchain’s immutability also works against the attacker: every operational decision they make is permanently and publicly visible. This gives investigators the opportunity to map campaign infrastructure, timelines and tactics using free, public data. These findings, in turn, can be used to generate signatures and behavioral detections which can be more effective against this tactic. 

The playbook for this class of threat now exists. Unlike the attacker’s infrastructure, that knowledge can’t be rotated away.