GuidePoint Security (Vendor): news timeline & CVEs

Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes

Malware operators hide C2 in Polygon blockchain contracts via EtherHiding, delivering a browser-based banking trojan that steals bank logins and 2FA codes from 479 sites.

GuidePoint Security uncovered a campaign active since at least November 2025 that injected JavaScript into at least 31 legitimate websites to show fake CAPTCHA prompts. Victims who paste the PowerShell command into Windows Run get a scheduled task named Enter and a backdoor that queries 15 observed Polygon smart contracts for its current C2 address, a technique known as EtherHiding. The backdoor installed a browser-extension banking trojan targeting roughly 479 financial and cryptocurrency sites, intercepting credentials and 2FA codes with web-injects, keylogging, screen capture, and wallet theft. Some infrastructure, including active C2 domains and an exposed build server with seven actively exploited vulnerabilities, remains live.

Cyber Security NewsSep 21, 09:24 UTC · 5d agoMalware in the wild 2 sources1

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.

Symantec's Threat Hunter Team (Broadcom) reports that since February 2026 attackers have used the legitimate signed node.exe binary and interpreted scripts to deliver implants while evading signature-based detection, hitting government departments, technology companies, and hotels. One intrusion at an Asian technology firm (March 23–July 25, 2026) used ClickFix social engineering, the official Node.js installer, and EtherHiding to fetch commands via the Ethereum blockchain after AdaptixC2 and Cobalt Strike attempts were blocked. Related chains involve KongTuke (Woodgnat) using ModeloRAT, Mistic, NexShield, and GateKeeper, plus C2Looper, AsukaStealer, and EtherRAT; GuidePoint Security separately linked a fake-CAPTCHA ClickFix campaign to at least 31 compromised organizations using the Polygon blockchain as a dynamic C2 address book.

The Hacker NewsSep 3, 10:43 UTC · 23d agoThreat actor in the wild1

GuidePoint Security

Timeline2 articles

Appears with

Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks