ClickFix operator's blockchain C2 off the public ledger: 4 months, ~127 hosts

Hiding in Plain Ledger: Four Months of a ClickFix Operator's Blockchain C2 | Melted in HexHiding in Plain Ledger: Four Months of a ClickFix Operator's Blockchain C2 July 16, 2026 · 12 min · 2369 words · Melted in Hex Table of ContentsBackground Summary The compromised sites The on-chain C2 The ClickFix lure The payload Who’s still infected Detection and hunting Indicators (IOCs) What to do

To hide its command-and-control server, this operation writes the address onto a public blockchain. That makes the C2 impossible to seize or sinkhole — but it also means every time the operator moves servers, they leave a permanent, timestamped entry in a ledger anyone can read. I pulled that ledger. It runs to four months and roughly 127 delivery hosts from a single smart contract , and it was still updating the day I looked. The framework itself is ErrTraffic , a ClickFix Malware-as-a-Service already documented by HudsonRock LevelBlue / SpiderLabs and Sekoia the contract I trace is the one Sekoia calls the “Analytics” cluster . Building on that work, this is an outside-in reconstruction of how legible such an operation is from public data alone: the full on-chain rotation history, a July map of who is still infected, and the payload the cluster is dropping today — all without touching attacker infrastructure.

Figure 1: The chain. A hacked WordPress site (1) carries the injected loader in one of two forms (plaintext or base64+XOR) and reads a Polygon contract to find the current delivery host (2); that host serves a fake Cloudflare page that copies PowerShell to the clipboard (3); the user runs it (4); a Go stealer lands, pulls its config from the C2 (5), and uploads the stolen data (6). The same C2 channel can also push a next-stage payload (7) — a loader capability present but off in this run. The only fixed point is the contract. Background# ErrTraffic is a rented ClickFix kit (advertised by the actor “LenAI” on Exploit.IN since December 2025) injected into compromised WordPress sites; it resolves its C2 from a Polygon smart contract via EtherHiding rather than a hard-coded domain. The contract here, 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308, is Sekoia’s “Analytics” cluster : one stable contract, C2 rotated roughly daily, historically dropping Vidar (April–May 2026), backed by the session-manager.php WordPress MU-plugin backdoor. For the framework internals, the MaaS economics and the backdoor, read the HudsonRock, LevelBlue and Sekoia write-ups linked above. Everything below is my own hands-on tracking of that contract, current to July 2026. Summary# Framework ErrTraffic (ClickFix MaaS) — Sekoia’s “Analytics” cluster Resolver Polygon contract 0x0820…D308, selector 0x38bcdc1c (getURL()), raced across public RPCs (EtherHiding)On-chain history 147 update transactions → ~127 distinct delivery hosts, 11 Mar → 16 Jul 2026, still live Lure Fake Cloudflare “Verify you are human” page → clipboard PowerShell (ClickFix)Loader powershell -w h … Invoke-WebRequest … SEE_MASK_NOZONECHECKS=1Payload (July) 3 MB Go 1.25.4 infostealer, symbol-obfuscated, fake self-signed cert (CN spoofs etsy.com)Config Not embedded — 20-browser + 48-rule grabber config delivered live by the C2C2 / exfil telegram[.]me/r7t3at dead-drop → data uploaded over TLS to kwt[.]ambiltogel[.]net; zewaplus[.]club serves runtime modules (loader-capable)My additions full on-chain rotation timeline · July victim pivot (37 sites not previously listed) · live-injection confirmation · the current Go payloadThe compromised sites# The traffic comes from legitimate WordPress sites, injected with a small script that runs on every page , high in the document — the signature of a server-side compromise (the session-manager.php MU-plugin backdoor documented by Monarx/LevelBlue/Sekoia), not a single defaced page. Among the sites I saw serving it is a Romanian municipal-government subdomain , eficienta-energetica-leonida.primariapetrosani.ro.

Figure 2: The lure served live on a government subdomain (primariapetrosani.ro). The WordPress chrome behind it confirms the CMS; each visit mints a fresh fake “Cloudflare ID” to look convincing. I saw the injected loader in two variants , differing only in how they hide the same contract, selector, and RPC list: Variant A — plaintext. Contract, selector, and RPC endpoints as readable string literals; trivial to spot on view-source. Variant B — base64 + XOR. The same values packed into an atob() blob, XOR-decoded at runtime before the eth_call. Nothing sensitive is visible in page source until it runs. (This is the obfuscation LevelBlue documents for v3.) Because both share the contract, selector, and RPC list, searching victim pages for the domain finds nothing, but searching for that shared fingerprint finds them all.

Figure 3: The two observed variants. Left: contract, selector and RPC list in plaintext. Right: the same values hidden in a...

ClickFix operator's blockchain C2 off the public ledger: 4 months, ~127 hosts

Related Articles

(no title)

Scientists reverse brain aging, with a nasal spray

AI has torched the market for junior programmers

Al Vigier: Canada's AI strategy shouldn't include secret Palantir bills

The Anatomy of an AI-Native Org