A malware operation that has been running since at least November 2025 is using the Polygon blockchain to hide the address of its command-and-control (C2) servers, making the infrastructure far harder to block or take down than a normal domain-based setup.
The technique, dubbed EtherHiding, was documented by GuidePoint Security in a report shared with Cyber Security News. Instead of hardcoding a C2 address inside the malware, the implant queries a smart contract on Polygon, which returns an encrypted address that the malware decodes locally (base64 decode → byte-order reversal → XOR against a key → UTF-8). Changing the destination server costs the operators only a small blockchain transaction — no need to rebuild or re-distribute the malware, and no single domain for defenders to blocklist.
From a fake CAPTCHA to a banking trojan
Victims are pulled in through legitimate business websites that attackers have altered with injected JavaScript. Visitors arriving from Google or Bing search results may be shown a fake "verify you're human" overlay — a ClickFix-style lure — that instructs them to press Win+R, paste a command, and hit Enter. Believing they're completing a routine verification step, victims instead launch the infection themselves.
The pasted command creates a scheduled task named "Enter" that retries every 60 seconds to pull down next-stage PowerShell scripts, and a Windows registry value (HKCU...\PersonalizedUpdates) gives the malware persistence across reboots. Once installed, the backdoor calls out to the Polygon smart contract to learn where its real C2 server currently lives.
GuidePoint found that the backdoor was later used to push a fake browser extension that poses as legitimate software while functioning as a banking trojan. It intercepts usernames, passwords and two-factor codes, and uses web-inject content to target roughly 479 banking and cryptocurrency sites. The extension can also capture browser data, log keystrokes, record the screen and video, and pull credentials from password managers and crypto wallets.
Why it matters
The campaign resembles ClickFix-driven ransomware access techniques, but the blockchain layer makes it unusually resilient: when a C2 address is replaced, infected machines simply fetch the new one at their next check-in, while the earlier infection stages stay untouched. Some of the command domains and compromised websites tied to the campaign are still live, so researchers are treating it as an ongoing threat rather than a closed incident. Notably, the attackers' own infrastructure isn't flawless — one build-and-staging server was found exposing its origin IP address while running seven vulnerabilities that are actively exploited in the wild.
What to do
Because blocklisting a rotating blockchain-backed address is far less effective than usual, defenders should prioritize behavioral detection: watch for a scheduled task named "Enter," unexpected PowerShell activity, paired scripts dropped into a user's temp folder, the "PersonalizedUpdates" registry value, and outbound queries to Polygon blockchain infrastructure. Organizations that have no legitimate need for blockchain access can safely block or alert on that traffic outright, cutting the malware off before it learns its current server.
Teams should also restrict unapproved browser extensions, audit new Chrome Native Messaging host registrations, and treat any confirmed rogue extension install as a credential-compromise event — resetting passwords for banking, exchange and other sensitive accounts from a clean, uninfected device.
Source: Cyber Security News →