ClickFix: Exploiting Compromised WordPress Sites with a Polygon-Based C2 Infrastructure

Overview

Cybercriminals continue to evolve their delivery techniques by combining compromised websites, obfuscated JavaScript, and blockchain technology. In a recent campaign, we observed threat actors compromising legitimate WordPress websites to inject malicious ClickFix code that ultimately delivers malware to unsuspecting visitors.

What makes this campaign particularly interesting is that the malicious infrastructure is not hardcoded within the injected JavaScript. Instead, the script retrieves its configuration from a Polygon smart contract at runtime, allowing the threat actor to rotate infrastructure without modifying every compromised website.

This approach significantly increases the resilience of the campaign while making traditional static detection far less effective. Figure 1 illustrates the attack flow of the observed campaign.

Figure 1: Clickfix Attack Flow

Attack Overview

The attack begins with a legitimate WordPress website that has been compromised. Instead of redirecting visitors immediately to a phishing or malware site, the attacker injects an obfuscated JavaScript payload into the page. Figure 2 illustrates the injected code of a domain.

Figure 2: Malicious Code Injected into Infected Website

The injected code is encoded using Base64 and runtime XOR decryption techniques, making it difficult for analysts and security tools to determine its true purpose through static inspection.

Once executed inside the visitor's browser, the JavaScript performs an Ethereum JSON-RPC eth_call against a Polygon smart contract as shown in Figure 3. The response contains the hex values of the active domain that hosts the latest ClickFix payload. Figure 4 shows the decoded C2.

Figure 3: Retrieving C2 Using ETH_CALL

Figure 4: Decoded C2

The script then dynamically injects that domain into the page and loads the next-stage JavaScript directly from the attacker-controlled infrastructure.

At no point is the final payload URL permanently stored inside the compromised WordPress site.

C2 Payload Retrieval

Once the C2 domain is retrieved, the malicious code dynamically injects a <script> tag that references the returned domain. This causes the compromised website to automatically download the next-stage payload and execute the ClickFix code. Figure 5 shows the injected script.

Malicious URL:

hxxps://authorization-cdn-press-enter.info/api.php?s=7590ecff04b7cf42db53aa9cdc02bd41af9499874c3c6ba5

Figure 5: Inject Code

The payload is encoded and encrypted using XOR encryption. Once decrypted, it reveals the ClickFix code responsible for injecting the appropriate malicious script based on the victim's operating system. Figure 6 shows the decrypted code.

Figure 6: ClickFix – Deobfuscated Injected JavaScript

Why Use a Smart Contract?

Using a Polygon smart contract as a configuration source provides several operational advantages.

• Infrastructure Rotation - The attacker can change payload domains without modifying every compromised website.
• Resilience - The smart contract address remains constant while the associated infrastructure evolves.
• Separation of Components - The compromised WordPress site never permanently contains the active payload domain.
• Reduced Static Indicators - Static scanners inspecting the HTML or JavaScript may never observe the final malicious domain.
• Decentralized Availability - Any public Polygon RPC endpoint can return the current configuration, reducing reliance on a single web server.

Figure 7: ClickFix – Polygon Smart Contract C2 Domains

Challenges for Defenders

Traditional web scanning often focuses on:

• Known malicious URLs
• Suspicious JavaScript
• Hardcoded C2 domains

This campaign deliberately avoids embedding those indicators.

Instead, defenders should monitor for:

• Browser-side Ethereum JSON-RPC requests
• Unexpected eth_call operations
• Runtime Base64 decoding
• Dynamic script injection
• Calls to public blockchain RPC endpoints from websites that normally should not interact with blockchain infrastructure

These behavioral indicators are far more valuable than searching for individual domains.

Detection Recommendations

Organizations should consider monitoring for:

• Newly modified WordPress theme or plugin files
• Unauthorized administrator accounts
• JavaScript containing large Base64 blobs
• Use of eval(), Function(), or similar dynamic execution patterns
• Browser requests to Polygon RPC providers
• Dynamic creation of <script> elements
• Runtime retrieval of remote JavaScript after blockchain queries

Security teams should also inspect web server logs for unauthorized modifications and verify the integrity of WordPress installations regularly.

Conclusion

This campaign demonstrates how attackers continue to modernize their infrastructure.

Rather than embedding payload locations directly into compromised websites, they use blockchain as a resilient configuration layer that returns the active payload domain on demand. Combined with runtime JavaScript decryption and ClickFix social engineering, this architecture reduces static indicators and allows the attacker to update infrastructure with minimal effort.

For defenders, the lesson is clear: detecting modern web-based malware requires looking beyond hardcoded URLs. Runtime behavior, blockchain interactions, dynamic script loading, and unusual browser activity provide stronger signals than static signatures alone.

As threat actors continue to experiment with decentralized technologies, defenders should expect blockchain-backed configuration techniques to become increasingly common in phishing and malware delivery campaigns.

IOCs

• 178.16.52.101
• www[.]authorization-cdn-press-enter[.]info
• authorization-cdn-press-enter[.]info
• www[.]authorization-id-code[.]info
• authorization-id-code[.]info
• www[.]authorization-code[.]info
• www[.]authorization-code[.]beer
• www[.]codeverificatrorcl[.]info
• authorization-code[.]beer
• mail[.]thewellformedwoman[.]com
• s1[.]thewellformedwoman[.]com
• ftp[.]thewellformedwoman[.]com
• autodiscover[.]thewellformedwoman[.]com
• autoconfig[.]thewellformedwoman[.]com
• codeverificatrorcl[.]info
• authorization-code[.]info
• www[.]idverification-cdn[.]info
• idverification-cdn[.]info
• www[.]verificationscodes[.]beer
• verificationscodes[.]beer
• www[.]verification-claude-cdn[.]beer
• verification-claude-cdn[.]beer
• code[.]verification-claude-cdn[.]beer
• www[.]claudverification-id[.]beer
• claudverification-id[.]beer
• www[.]idverification-code[.]beer
• idverification-code[.]beer
• www[.]codecerification[.]beer
• www[.]code-verification-js[.]beer
• www[.]verification-code-js[.]beer
• codecerification[.]beer
• code-verification-js[.]beer
• verification-code-js[.]beer
• www[.]svs-verificationdate[.]beer
• svs-verificationdate[.]beer
• www[.]cdn-verification-cloud[.]boats
• cdn-verification-cloud[.]boats
• www[.]verification-js-cdn[.]boats
• verification-js-cdn[.]boats
• www[.]framework-css-styles-js[.]beer
• www[.]thewellformedwoman[.]com
• framework-css-styles-js[.]beer
• www[.]ethercdnns[.]beer
• ethercdnns[.]beer
• www[.]clhfgcomacdn[.]beer
• clhfgcomacdn[.]beer
• www[.]ladydosug[.]love
• www[.]istounscnnd[.]beer
• www[.]trunnsns[.]beer
• www[.]mstclaudens[.]beer
• www[.]xdavnode[.]pro
• istounscnnd[.]beer
• mstclaudens[.]beer
• trunnsns[.]beer
• www[.]hftplcnsns[.]beer
• www[.]lskannsserv[.]beer
• thewellformedwoman[.]com
• hftplcnsns[.]beer
• lskannsserv[.]beer
• www[.]hasmeverdcdn[.]beer
• xdavnode[.]pro
• hasmeverdcdn[.]beer
• www[.]claufancdn[.]beer
• www[.]srtydnnc[.]beer
• www[.]bhfgtrns-js[.]beer
• srtydnnc[.]beer
• bhfgtrns-js[.]beer
• claufancdn[.]beer
• www[.]tescdnlast[.]beer
• www[.]smfcdnbb[.]beer
• www[.]shssshdscn[.]beer
• www[.]snccdn-framework[.]beer
• www[.]testapi34726[.]sbs
• tescdnlast[.]beer
• testapi34726[.]sbs
• smfcdnbb[.]beer
• www[.]nstdcs[.]beer
• snccdn-framework[.]beer
• shssshdscn[.]beer
• nstdcs[.]beer
• www[.]framework-jsoncdn[.]beer
• www[.]gppcdnns[.]beer
• framework-jsoncdn[.]beer
• www[.]ladydosug[.]live
• www[.]ladydosug[.]top
• www[.]hpscdn[.]beer
• gppcdnns[.]beer
• ladydosug[.]live
• ladydosug[.]love
• hpscdn[.]beer
• www[.]nvbfcdnclaud[.]beer
• www[.]lnfcdnclad[.]beer
• ladydosug[.]top
• nvbfcdnclaud[.]beer
• lnfcdnclad[.]beer
• www[.]clainasns[.]beer
• www[.]nshtjscdn[.]beer
• www[.]nfstsrcdn[.]beer
• nshtjscdn[.]beer
• clainasns[.]beer
• www[.]gdnssljs[.]beer
• www[.]biyaconserver[.]beer
• www[.]npanssltejs[.]beer
• nfstsrcdn[.]beer
• www[.]bootstrup-framework-js[.]beer
• biyaconserver[.]beer
• gdnssljs[.]beer
• npanssltejs[.]beer
• www[.]nshostvps[.]beer
• www[.]chekbrow[.]beer
• nshostvps[.]beer
• bootstrup-framework-js[.]beer
• www[.]smtnscerver[.]beer
• smtnscerver[.]beer
• chekbrow[.]beer
• www[.]sns-clauder-cdn[.]beer
• www[.]anlytic-js-cloud[.]beer
• www[.]visual-ns-portal[.]beer
• visual-ns-portal[.]beer
• sns-clauder-cdn[.]beer
• www[.]slndcdnclaud[.]beer
• anlytic-js-cloud[.]beer
• www[.]bootstrup-cdnmaper[.]beer
• www[.]nsserv-bootstru[.]beer
• www[.]ns1cdnclaude[.]beer
• slndcdnclaud[.]beer
• bootstrup-cdnmaper[.]beer
• nsserv-bootstru[.]beer
• ns1cdnclaude[.]beer
• www[.]slngftr[.]beer
• slngftr[.]beer
• www[.]travel-js-ns[.]beer
• www[.]smetana-js[.]beer
• www[.]mistraljs[.]beer
• smetana-js[.]beer
• travel-js-ns[.]beer
• www[.]lsikjsns[.]beer
• www[.]ssns-cdn-ns[.]beer
• lsikjsns[.]beer
• mistraljs[.]beer
• ssns-cdn-ns[.]beer
• www[.]sane-cdn-js[.]beer
• www[.]sr-hostes-js[.]beer
• www[.]darndcs-js[.]beer
• www[.]bkscndclou[.]beer
• sr-hostes-js[.]beer
• sane-cdn-js[.]beer
• bkscndclou[.]beer
• darndcs-js[.]beer
• www[.]bcncdncl-ns[.]beer
• bcncdncl-ns[.]beer
• www[.]viscdnclaud[.]beer
• www[.]ldnscreatejs[.]beer
• viscdnclaud[.]beer
• www[.]testerlau[.]lat
• ldnscreatejs[.]beer
• testerlau[.]lat
• www[.]nfsclaudecdn[.]beer
• nfsclaudecdn[.]beer
• www[.]ssjscrybootstrup[.]beer
• ssjscrybootstrup[.]beer
• www[.]clacndjsvulnarbi[.]beer
• clacndjsvulnarbi[.]beer
• www[.]las-js-claud[.]beer
• www[.]claudjaframework[.]beer
• las-js-claud[.]beer
• claudjaframework[.]beer
• www[.]framesavecloudjs[.]beer
• framesavecloudjs[.]beer
• www[.]olnsclaud[.]beer
• www[.]frameworkjsbns[.]beer
• frameworkjsbns[.]beer
• www[.]nsserdns[.]beer
• www[.]claudesave[.]beer
• www[.]nsbdnscloud[.]beer
• olnsclaud[.]beer
• claudesave[.]beer
• nsbdnscloud[.]beer
• nsserdns[.]beer
• www[.]cloude-js-server[.]beer
• www[.]best-claudns-js[.]beer
• best-claudns-js[.]beer
• cloude-js-server[.]beer
• www[.]awesomeisojs[.]beer
• awesomeisojs[.]beer
• www[.]ns-claude-js[.]beer
• www[.]ntsnsdns[.]beer
• ns-claude-js[.]beer
• ntsnsdns[.]beer
• www[.]vjscloudjsns[.]beer
• www[.]nslsconscloud[.]beer
• vjscloudjsns[.]beer
• nslsconscloud[.]beer
• www[.]ns-server-jscdn[.]beer
• www[.]lcstdnsns[.]beer
• ns-server-jscdn[.]beer
• lcstdnsns[.]beer
• www[.]cloudcdnginx[.]beer
• cloudcdnginx[.]beer
• www[.]bootstrap-maxcdn[.]beer
• www[.]dhnsdns[.]beer
• bootstrap-maxcdn[.]beer
• dhnsdns[.]beer
• www[.]fijscdn[.]beer
• www[.]bootstrup-cdn-ns[.]beer
• www[.]bbdsnssserver[.]beer
• www[.]lsnsdns[.]beer
• www[.]fontawesome-js-cdn[.]beer
• www[.]bilfojsclod[.]beer
• bootstrup-cdn-ns[.]beer
• fontawesome-js-cdn[.]beer
• bbdsnssserver[.]beer
• lsnsdns[.]beer
• fijscdn[.]beer
• bilfojsclod[.]beer
• www[.]dreff-nsdns[.]beer
• dreff-nsdns[.]beer
• www[.]vsactivens[.]beer
• vsactivens[.]beer
• www[.]jsframeworkns[.]beer
• www[.]nsservclod[.]beer
• www[.]clnsdns[.]beer
• nsservclod[.]beer
• jsframeworkns[.]beer
• clnsdns[.]beer
• www[.]bnnsbdsdn-js[.]beer
• www[.]polygon-date[.]beer
• www[.]mnoskemp[.]beer
• www[.]bnsclod[.]beer
• bnnsbdsdn-js[.]beer
• www[.]vnmstokns[.]beer
• mnoskemp[.]beer
• bnsclod[.]beer
• polygon-date[.]beer
• vnmstokns[.]beer
• www[.]ghdnsserverns[.]beer
• ghdnsserverns[.]beer
• www[.]smnsdns[.]beer
• www[.]sssndns[.]beer
• www[.]vnmdnns[.]beer
• smnsdns[.]beer
• sssndns[.]beer
• vnmdnns[.]beer
• www[.]neiwteamcdn[.]beer
• neiwteamcdn[.]beer
• www[.]cgfuryclaud[.]shop
• cgfuryclaud[.]shop
• www[.]exdanteam[.]beer
• www[.]l3cdnns[.]beer
• exdanteam[.]beer
• l3cdnns[.]beer
• www[.]lenteam[.]beer
• www[.]dncloteam[.]beer
• lenteam[.]beer
• www[.]sdnssmdf-js[.]beer
• www[.]vsbnsbootstrup[.]beer
• dncloteam[.]beer
• www[.]teamcss[.]beer
• www[.]siteamnsserv[.]beer
• siteamnsserv[.]beer
• vsbnsbootstrup[.]beer
• sdnssmdf-js[.]beer
• teamcss[.]beer
• www[.]wpteamcdn[.]beer
• www[.]js-server[.]beer
• www[.]lndteam[.]beer
• js-server[.]beer
• www[.]sdhscndnssl[.]beer
• www[.]stabcdnvlc[.]beer
• www[.]lckcdnjs[.]beer
• lndteam[.]beer
• wpteamcdn[.]beer
• lckcdnjs[.]beer
• sdhscndnssl[.]beer
• stabcdnvlc[.]beer
• www[.]workcdnmass[.]beer
• workcdnmass[.]beer
• www[.]capcha-cdn-js[.]beer
• www[.]cdn-plugin-js[.]beer
• www[.]ssg-cdn[.]beer
• ssg-cdn[.]beer
• capcha-cdn-js[.]beer
• cdn-plugin-js[.]beer
• www[.]rpc-cloud[.]beer
• rpc-cloud[.]beer
• www[.]localcloudcss[.]sbs
• localcloudcss[.]sbs
• www[.]cdn-yethounds[.]beer
• cdn-yethounds[.]beer
• www[.]verification-cdn-cloud[.]beer
• www[.]lcates-vs[.]beer
• verification-cdn-cloud[.]beer
• lcates-vs[.]beer
• www[.]cloud-save-image[.]sbs
• cloud-save-image[.]sbs
• www[.]virtual-cdncloud[.]sbs
• virtual-cdncloud[.]sbs
• www[.]winecdn[.]sbs
• www[.]cdn-2faclov[.]sbs
• cdn-2faclov[.]sbs
• winecdn[.]sbs
• www[.]mandare[.]life
• mandare[.]life
• rpc-polygon[.]beer
• www[.]rpc-polygon[.]beer
• str-smcontrcats[.]cfd
• www[.]ai-nexora[.]sbs
• ai-nexora[.]sbs
• www[.]all-imager-hst[.]click
• www[.]store-image[.]shop
• all-imager-hst[.]click
• store-image[.]shop
• www[.]nexus-server[.]click
• nexus-server[.]click