EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
EtherHiding malware uses Polygon blockchain smart contracts for resilient C2 and steals banking credentials from nearly 500 targeted domains.
The EtherHiding campaign leverages Polygon blockchain smart contracts to host resilient command-and-control infrastructure, allowing attackers to rotate C2 domains without modifying the deployed payload. Active since late 2025, the operation has compromised over 30 legitimate websites, using FakeCaptcha overlays to trick users into executing a PowerShell dropper. The malware evolves from a general backdoor to a banking trojan targeting approximately 479 financial and cryptocurrency domains, using the blockchain to obfuscate C2 addresses and evade traditional takedown methods.
- Campaign uses Polygon blockchain smart contracts for resilient C2 infrastructure.
- Attack starts with compromised websites and fake CAPTCHAs to trick users into running commands.
- Delivers a real-time banking trojan targeting nearly 500 financial domains.
- Malware uses PowerShell for execution and establishes persistence via registry keys.
- Operators have compromised at least 31 legitimate business websites for distribution.
- ATT&CK
- T1059.001 PowerShellT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup FolderT1105 Ingress Tool TransferT1185 Browser Session Hijacking
- Vendors
- Microsoft
- Products
- Google Chrome
- Malware
- EtherHiding
- Organizations
- GuidePoint SecurityPolygon
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3262d48df5d75e34.shop | tructure includes hivinest[.]online , insinght[.]site , and 3262d48df5d75e34[.]shop , which were reported as active at the time of the resear |
| domain | 45a3158594d6ba76.fun | ing Contract (0xa982e044…) Insinght[.]site Delivery Domains 45a3158594d6ba76[.]fun Delivery Domains 82d35f9b891c987a[.]fun Delivery Domains |
| domain | 82d35f9b891c987a.fun | te Delivery Domains 45a3158594d6ba76[.]fun Delivery Domains 82d35f9b891c987a[.]fun Delivery Domains 9082b2a18f2e00fe[.]fun Note: IP addresse |
| domain | 9082b2a18f2e00fe.fun | un Delivery Domains 82d35f9b891c987a[.]fun Delivery Domains 9082b2a18f2e00fe[.]fun Note: IP addresses and domains are intentionally defanged |
| domain | ddcd62e16a428c8e.shop | ted as active at the time of the research. A fourth domain, ddcd62e16a428c8e[.]shop , was placed on hold by its registrar. Crucially, the act |
| domain | dsgnfwd.xyz | 2d34339c…) hivinest[.]online Sibling Contract (0xa982e044…) Dsgnfwd[.]xyz Sibling Contract (0xa982e044…) Hubcreative[.]shop Sibling |
| domain | hivinest.online | ate event-based enumeration. The C2 infrastructure includes hivinest[.]online , insinght[.]site , and 3262d48df5d75e34[.]shop , which w |
| domain | hubcreative.shop | (0xa982e044…) Dsgnfwd[.]xyz Sibling Contract (0xa982e044…) Hubcreative[.]shop Sibling Contract (0xa982e044…) Insinght[.]site Delivery D |
| domain | insinght.site | eration. The C2 infrastructure includes hivinest[.]online , insinght[.]site , and 3262d48df5d75e34[.]shop , which were reported as ac |
From the original article
4 min read at gbhackers.com
A newly uncovered EtherHiding campaign has turned the Polygon blockchain into a resilient command-and-control mechanism, allowing operators to rotate malware infrastructure without modifying the payload deployed on victim systems.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.