EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials

A newly uncovered EtherHiding campaign has turned the Polygon blockchain into a resilient command-and-control mechanism, allowing operators to rotate malware infrastructure without modifying the payload deployed on victim systems.

The operation, active since at least November 2025, has compromised at least 31 legitimate business websites and evolved from deploying a general-purpose PowerShell backdoor to distributing a real-time banking trojan targeting roughly 479 financial and cryptocurrency domains.

Rather than storing a C2 address in plaintext within the payload, the implant queries a hardcoded Polygon smart contract through public remote procedure call endpoints and decrypts the returned C2 domain at runtime.

This technique, known as EtherHiding, turns the blockchain into an attacker-controlled, dynamically updateable address book.

The operational benefit is significant. Conventional C2 disruption often relies on blocking or seizing a malicious domain or IP address.

In this case, the adversary can change the C2 destination through an inexpensive smart-contract update, directing every infected endpoint to fresh infrastructure on its next beacon.

Because Polygon is a distributed public ledger rather than a conventional hosting provider, defenders cannot simply remove the underlying C2 reference through a registrar or hosting takedown.

The campaign begins on compromised websites, including business sites reached through Bing or Google results.

Malicious JavaScript injects a FakeCaptcha or ClickFix overlay that instructs visitors to press Windows+R, paste a supplied command, and execute it.

The social-engineering step creates a Windows Scheduled Task named “Enter,” configured to retry a hidden PowerShell downloader every 60 seconds until payload delivery succeeds.

After execution, the dropper writes paired PowerShell scripts into the user’s Temp directory.

One establishes reboot persistence through the PersonalizedUpdates value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run; the other acts as the core C2 agent.

The scheduled task is subsequently removed, reducing obvious evidence while preserving persistence through the Registry.

GuidePoint Security’s DFIR team discovered the activity, during a business email compromise investigation, where investigators identified a Polygon smart contract embedded in the malware’s execution chain.

EtherHiding Malware Attack

The backdoor then queries one of several embedded Polygon RPC endpoints, retrieves an encrypted C2 value from the smart contract, and begins encrypted communications with the active server.

Researchers said the agent uses a custom XOR cipher for traffic and places encrypted beacon data in the HTTP Authorization header rather than the request body.

It also derives a victim identifier from the Windows MachineGuid, hostname, and username, then supports remote PowerShell execution through either a new process or Invoke-Expression.

This gives the operator flexible post-compromise access without requiring a separate malware family for every task.

Blockchain analysis exposed the campaign’s scale. Investigators identified 15 smart contracts deployed in six operational waves over seven months, controlled through two wallets.

The earliest contracts emitted on-chain events when their C2 values changed, enabling researchers to pivot from one contract to additional infrastructure.

Later contracts were intentionally silent, with no event emissions, suggesting the operators adjusted their smart-contract templates to frustrate event-based enumeration.

The C2 infrastructure includes hivinest[.]online, insinght[.]site, and 3262d48df5d75e34[.]shop, which were reported as active at the time of the research.

A fourth domain, ddcd62e16a428c8e[.]shop, was placed on hold by its registrar.

Crucially, the actors appear to keep multiple C2 domains operational in parallel, meaning a single domain blocklist entry offers limited protection.

The threat has become more serious as the operators began delivering a fake browser extension capable of intercepting credentials and two-factor authentication codes in real time from banking and cryptocurrency services.

The development shifts the campaign from generic remote access to direct financial theft and account takeover risk.

Defenders should monitor for unexpected outbound connections to Polygon RPC services, especially from endpoints that have no legitimate blockchain requirement.

High-value telemetry includes creation of the “Enter” scheduled task, PowerShell activity in user Temp directories, accesses to the Windows MachineGuid, and the PersonalizedUpdates Run key.

Organizations should also investigate suspicious browser-extension installation activity and newly created Chrome Native Messaging host registrations.

EtherHiding complicates traditional C2 takedowns, but it also leaves an immutable operational trail.

Every contract deployment and update is permanently recorded on-chain, allowing defenders to map wallets, contract templates, infrastructure rotations, and campaign timelines long after an operator changes domains.

IOCs

Associated Contract	Domain / Indicator
Primary Contract (0xde2d34339c…)	3262d48df5d75e34[.]shop
Primary Contract (0xde2d34339c…)	ddcd62e16a428c8e[.]shop
Primary Contract (0xde2d34339c…)	hivinest[.]online
Sibling Contract (0xa982e044…)	Dsgnfwd[.]xyz
Sibling Contract (0xa982e044…)	Hubcreative[.]shop
Sibling Contract (0xa982e044…)	Insinght[.]site
Delivery Domains	45a3158594d6ba76[.]fun
Delivery Domains	82d35f9b891c987a[.]fun
Delivery Domains	9082b2a18f2e00fe[.]fun

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC