Hackers Turned Ethereum Into a Secret Messaging System for Malware
North Korea-linked XCTDH malware encodes C2 server addresses into Ethereum recipient addresses, giving its RAT and credential stealer resilient command channels.
68
Organization
BNB Smart Chain
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 9, 2026
- Last mentionedSep 29, 2026
Timeline
2 articles · newest firstHackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware
Cisco Talos details ClickFix campaigns abusing fake Google CAPTCHA prompts, WebDAV and BNB Smart Chain to deploy the Amatera infostealer.
55
Appears with
- Ransom-ISACorganization · 1
- Ukrainian government organizationvictim · 1
- Cisco Talosvendor · 1
- TRONorganization · 1
- XCTDHorganization · 1
- ZigCryptoStealerproduct · 1
- ACR Stealerproduct · 1
- Amateramalware · 1
- ZigCryptoStealermalware · 1
- NetSupport Managerproduct · 1
- UAT-10820threat actor · 1
- Cloudflare Workersproduct · 1
- Ethereumorganization · 1
- Aptosorganization · 1
- Amateraproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.