Security1 publisher3 min readPublished
One Polygon smart contract rotated ClickFix lure hosts three times in a single day
CTM360 tracked more than 17,000 compromised URLs serving a fake Cloudflare check whose next hostname arrives from an on-chain lookup. Microsoft put 47 percent of its 2025 initial-access cases down to the technique.
The Watch · Security desk
What happened
- CTM360 published a campaign-level analysis of more than 17,000 infected URLs serving fake Cloudflare verification pages, alongside a teardown of one compromised WordPress site done only from its responses to a visitor.
- Over a single day of analysis the contract returned three different lure hosts in sequence, and none of the compromised websites were modified to make the change.
- Microsoft attributed 47 percent of the initial-access cases its Defender Experts team handled in 2025 to ClickFix, placing it ahead of conventional phishing in that caseload.
- Targeting is decided server-side per visitor: the lure reports the operating system and version, and the operator returns a configuration choosing which platforms to attack and which page to serve.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint A blocklist of lure hostnames is stale before it ships, because one edit to an on-chain value moves every infected site within seconds and needs no change to any of them.
- decision Takedown requests have no addressee here, so the escalation path moves from registrars and hosts to endpoint process-execution telemetry on the machines where the pasted command runs.
- exposure The 90-day suppression cookie means an analyst or help-desk agent revisiting a URL a user reported can be served a clean page and close the ticket.
The clipboard step is what puts this outside the controls most enterprises bought for phishing. The page shows a problem the visitor believes is theirs to fix, writes a command to the clipboard, and asks the visitor to open a system interface they already trust, paste, and press Enter [12]. Because the command is pasted by an authenticated interactive user into a native, signed binary, CTM360 says the scanner has no vulnerability to find, the mail gateway usually has no attachment to detonate, and the browser reputation check has no download to score [13]. In the chain the firm traced, the end state was an information stealer running inside a signed Microsoft process [18].
Reading the current hostname costs the operator nothing. The injected script contains no attacker domain, and the visitor's own browser makes a free, read-only call to a smart contract on Polygon that returns an encoded string decoding to the live lure host, with no wallet and no transaction involved [4]. The same idea appears again further down the chain, where Telegram channel descriptions and a Steam profile page resolve the command-and-control address [7]. CTM360 treats two independent resolution mechanisms at two stages as a design decision [7].
About one in six of the URLs in the dataset was still serving the lure when CTM360 checked, and roughly 14,000 were not [1]. Cleanup on the compromised-site side is therefore running in the thousands. It is a separate job from the hostname rotation, which happened without any of the infected sites being edited [5].
In the sample CTM360 examined, Windows was switched on, macOS and Linux landing pages were built and held in reserve, and mobile was suppressed entirely [15]. The firm calls the arrangement deliberately hostile to analysis [19], and says the widespread belief that ClickFix is a Windows problem describes the current configuration and not the capability [16]. MITRE has listed Windows, macOS and Linux as affected platforms since it published sub-technique T1204.004, User Execution: Malicious Copy and Paste, in March 2025 [11].
The growth figures are vendor telemetry. Microsoft's 47 percent is a share of the engagements its own Defender Experts team handled, so it measures that caseload [9]. ESET measured a 517 percent rise into the first half of 2025 and a further 108 percent from the second half of 2025 to the first half of 2026 [10], which puts its first-half 2026 volume slightly above double the preceding six months [2].
CTM360 dates the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base [17]. The published summary did not disclose the sellers, the price, or the state actors. The 17,000-URL dataset supports the infrastructure finding; the market framing is the report's own assertion [1].
What to watch
- Whether the macOS and Linux landing pages CTM360 found held in reserve are switched on in a later sample.
- Whether Polygon RPC providers begin filtering the read-only contract reads that EtherHiding depends on.
- Whether CTM360's full report names the sellers, prices and state-sponsored users its summary asserts.