The campaign uses EtherHiding to dynamically update its command-and-control server, abusing the blockchain as an attacker-controlled address book.
ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain
Summary + source link. No paywalls, no tracking.