ClickFix Rotates 17,000 Fake Verification Pages via Blockchain

ClickFix has become the most common way attackers gain initial access to enterprise networks, according to a new report from security firm CTM360, and it does so without an exploit, an attachment, or a file written to disk. The technique starts when a visitor lands on a page that presents a problem they believe is theirs to solve, such as a verification step that will not complete, a browser that cannot render the page, a document that will not open, or a Mac that is low on storage. The page quietly writes the supposed fix to the computer's clipboard and instructs the user to open a system interface they already trust, paste the text, and press Enter. Because the command is run by an authenticated interactive user inside a native, signed, universally present binary, it looks exactly like legitimate administrative work and leaves no vulnerability for a scanner to find, no attachment for an email gateway to detonate, and no download for a browser reputation check to score.

The scale is now substantial. Microsoft attributed 47% of the initial-access cases handled by its Defender Experts team in 2025 to ClickFix, ahead of conventional phishing. ESET measured a 517% rise into the first half of 2025, and a further 108% increase between the second half of 2025 and the first half of 2026. In March 2025, MITRE gave the behavior its own sub-technique, T1204.004, User Execution: Malicious Copy and Paste, listing Windows, macOS and Linux as affected platforms. CTM360 consolidated two independent bodies of primary analysis with open-source research: a campaign-level analysis covering more than 17,000 infected URLs serving fake Cloudflare verification pages, around 3,000 of them still actively serving the lure at the time of writing, and a host-level analysis of a single compromised WordPress site examined entirely from the responses it returns to an ordinary visitor. Together they trace the full path from the injected page to an information stealer running inside a signed Microsoft process.

One finding is that the infrastructure is built to survive takedown. The injected script on a compromised website contains no attacker domain at all. Instead, when a visitor loads the page, their own browser makes a free, read-only call to a smart contract on the Polygon blockchain. A smart contract is a small program that runs on a blockchain and can return a value when queried. The contract returns an encoded string that decodes to the current lure hostname. No wallet, no transaction, and no cost are involved, a technique known as EtherHiding. During a single day of analysis, that contract returned three different lure hosts in sequence, and not one of the compromised websites was modified. The operator edits one on-chain value and every infected site follows within seconds. There is no registrar to complain to, no hosting provider to notify, and the RPC providers used to read the value are legitimate shared services that real applications depend on. The same architectural idea appears again further down the chain, where Telegram channel descriptions and a Steam profile page resolve the malware's command-and-control address. Two independent resolution mechanisms at two different stages is a design decision, not an accident: the kit is built so that no single takedown breaks it. The practical consequence is that blocking lure domains is close to worthless as a control because they rotate faster than any blocklist can be published.

Targeting is server-side, per-visitor, and deliberately hostile to analysis. The lure page reports the visitor's operating system and version back to the operator, which replies with a configuration naming which platforms to attack and which landing page to serve for each. In the sample CTM360 analyzed, Windows was switched on. macOS and Linux landing pages were built and held in reserve. Mobile was suppressed entirely, and a cookie suppressed the overlay for repeat visitors for 90 days. This undercuts a common assumption: the widespread belief that ClickFix is a Windows problem is a description of current configuration, not of capability, and it can be changed with a single server-side flag. The macOS branch was fully populated and functional; macOS lures are a mature parallel product line with their own pretexts, including a disk-space maintenance pretext styled as an Apple support article. The Linux slot existed and was empty. Running underneath all of this is a traffic distribution system that polls the operator roughly every 1.5 seconds and can silently mark a session verified without ever showing the malicious instruction. Researchers, sandboxes and crawlers get a clean page. Intended targets get the lure.

The payload is gated on machine identity, which should change how teams interpret their tooling. In the dropper recovered from the live host, a hardware and account fingerprint, made up of machine GUID, volume serial, computer name, BIOS manufacturer, system model, GPU and username, is base64-encoded directly into the download path. A dropper is a small program whose job is to fetch and install the actual malware. The command-and-control server therefore sees the victim's identity before it serves anything and can return a payload chosen per machine, or nothing at all. A sandbox is not merely detected and evaded here. It is served machine-specific content that is not the payload a real victim receives. Detonation-based verdicts on this chain are structurally unreliable, and the absence of a payload in a sandbox is not evidence that a site is clean. Controls that depend on recognizing attacker infrastructure will decay within hours. Controls that constrain what an interactive user is permitted to execute hold their value across every variant seen.

The two samples were analyzed independently, on different hosts, using different methods. One stops at the dropper because the payload was fingerprint-gated. The other follows the chain to the end: through three Telegram dead-drop resolvers and two layers of AES decryption, to Vidar Stealer executing inside a legitimately signed Microsoft binary by DLL side-loading. DLL side-loading means the malware places a malicious library where a legitimate program will load it, so the signed program runs the attacker's code. They recovered the same traffic-distribution API shape, which points to a shared kit rather than convergent design. Open-source research closes the loop: Sekoia's June 2026 analysis of the ErrTraffic framework identifies the exact Polygon contract CTM360 observed as belonging to an operator cluster that distributes Vidar exclusively. The payload one sample could not retrieve is the payload the cluster operating that contract is documented to deliver. CTM360 holds that correlation at moderate confidence; the framework is sold to multiple affiliates at around $380 a month, and cluster boundaries shift.

WordPress keeps appearing because it is not incidental. It is the substrate the delivery business is b