Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes
AI summary · glm-5.3-flashSummaries by Vani AI
Malware operators hide C2 in Polygon blockchain contracts via EtherHiding, delivering a browser-based banking trojan that steals bank logins and 2FA codes from 479 sites.
GuidePoint Security uncovered a campaign active since at least November 2025 that injected JavaScript into at least 31 legitimate websites to show fake CAPTCHA prompts. Victims who paste the PowerShell command into Windows Run get a scheduled task named Enter and a backdoor that queries 15 observed Polygon smart contracts for its current C2 address, a technique known as EtherHiding. The backdoor installed a browser-extension banking trojan targeting roughly 479 financial and cryptocurrency sites, intercepting credentials and 2FA codes with web-injects, keylogging, screen capture, and wallet theft. Some infrastructure, including active C2 domains and an exposed build server with seven actively exploited vulnerabilities, remains live.
Key facts
- EtherHiding stores C2 configuration in 15 Polygon smart contracts, letting operators swap C2 with cheap blockchain transactions
- Fake CAPTCHA overlay prompts victims to paste PowerShell into Windows Run, creating a scheduled task named Enter
- Browser extension backdoor targets ~479 banking and crypto sites, stealing logins, 2FA codes, and wallet data
- 31 compromised legitimate websites since November 2025; campaign still active with live C2 domains
- Researchers found an exposed build/staging server running seven actively exploited vulnerabilities
- ATT&CK
- T1204.002 Malicious FileT1059.001 PowerShellT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup FolderT1555.003 Credentials from Web Browsers
- Vendors
- GuidePoint SecurityMicrosoft
- Products
- Microsoft Defender
- Organizations
- GuidePoint Security
- Countries
- United StatesGermanyFranceCanada
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3262d48df5d75e34.shop | of Compromise (IoCs):- Type Indicator Description C2 domain 3262d48df5d75e34[.]shop Active C2 infrastructure C2 domain ddcd62e16a428c8e[.]sho |
| domain | 45a3158594d6ba76.fun | e Active sibling-contract C2 infrastructure Delivery domain 45a3158594d6ba76[.]fun Fake CAPTCHA delivery infrastructure Delivery domain 82d3 |
| domain | 67b3ac3e45812153.fun | [.]fun Fake CAPTCHA delivery infrastructure Delivery domain 67b3ac3e45812153[.]fun Fake CAPTCHA delivery infrastructure Delivery domain trui |
| domain | 82d35f9b891c987a.fun | [.]fun Fake CAPTCHA delivery infrastructure Delivery domain 82d35f9b891c987a[.]fun Fake CAPTCHA delivery infrastructure Delivery domain 9082 |
| domain | 9082b2a18f2e00fe.fun | [.]fun Fake CAPTCHA delivery infrastructure Delivery domain 9082b2a18f2e00fe[.]fun Fake CAPTCHA delivery infrastructure Delivery domain 67b3 |
| domain | 90happymoney.top | ocurrency web-inject configuration panel WebSocket endpoint 90happymoney[.]top:3001/ws Browser-extension command-and-control endpoint Po |
| domain | additionalver.com | igin IP address for onemm[.]net Traffic-distribution domain additionalver[.]com Traffic funnel infrastructure Traffic-distribution domain |
| domain | cleearpeyak.online | online Fake CAPTCHA delivery infrastructure Delivery domain cleearpeyak[.]online Fake CAPTCHA delivery infrastructure Delivery domain veru |
| domain | ddcd62e16a428c8e.shop | 3262d48df5d75e34[.]shop Active C2 infrastructure C2 domain ddcd62e16a428c8e[.]shop Inactive C2 infrastructure C2 domain hivinest[.]online Ac |
| domain | detsigen.site | ptocurrency web-inject configuration panel Web-inject panel detsigen[.]site Banking and cryptocurrency web-inject configuration panel |
| domain | dsgnfwd.xyz | domain hivinest[.]online Active C2 infrastructure C2 domain dsgnfwd[.]xyz Sibling-contract C2 infrastructure C2 domain hubcreative[ |
| domain | folfdighdd.xyz | [.]xyz Fake CAPTCHA delivery infrastructure Delivery domain folfdighdd[.]xyz Fake CAPTCHA delivery infrastructure Supporting domain on |
| domain | hivinest.online | dcd62e16a428c8e[.]shop Inactive C2 infrastructure C2 domain hivinest[.]online Active C2 infrastructure C2 domain dsgnfwd[.]xyz Sibling- |
| domain | hubcreative.shop | dsgnfwd[.]xyz Sibling-contract C2 infrastructure C2 domain hubcreative[.]shop Sibling-contract C2 infrastructure C2 domain insinght[.]s |
| domain | insinght.site | reative[.]shop Sibling-contract C2 infrastructure C2 domain insinght[.]site Active sibling-contract C2 infrastructure Delivery domain |
| domain | lanhd6549tdhse.top | e Traffic funnel infrastructure Traffic-distribution domain lanhd6549tdhse[.]top Traffic funnel infrastructure Web-inject panel purplepenc |
| domain | onemm.net | ]xyz Fake CAPTCHA delivery infrastructure Supporting domain onemm[.]net Build and staging server IP address 37.27.52[.]152 Origin |
| domain | pleasewaitcenter.top | m Traffic funnel infrastructure Traffic-distribution domain pleasewaitcenter[.]top Traffic funnel infrastructure Traffic-distribution domain |
| domain | promo-chatgpt.com | m Traffic funnel infrastructure Traffic-distribution domain promo-chatgpt[.]com Traffic funnel infrastructure Traffic-distribution domain |
| domain | purplepencel.online | 9tdhse[.]top Traffic funnel infrastructure Web-inject panel purplepencel[.]online Banking and cryptocurrency web-inject configuration panel |
| domain | skaybolt.online | p Traffic funnel infrastructure Traffic-distribution domain skaybolt[.]online Traffic funnel infrastructure Traffic-distribution domain |
| domain | truieparth.online | [.]fun Fake CAPTCHA delivery infrastructure Delivery domain truieparth[.]online Fake CAPTCHA delivery infrastructure Delivery domain clee |
| domain | veruisuealx.xyz | online Fake CAPTCHA delivery infrastructure Delivery domain veruisuealx[.]xyz Fake CAPTCHA delivery infrastructure Delivery domain folf |
| ipv4 | 37.27.52.152 | ting domain onemm[.]net Build and staging server IP address 37.27.52[.]152 Origin IP address for onemm[.]net Traffic-distribution do |
| sha256 | 00810c2e0ad5031b9fe5d2cfb4a6fb45a1c424d6b92be7ba3b1aaa7c55b10f8e | bdabd03a68a0bb209d07b1 Persistence script, sample 4 SHA-256 00810c2e0ad5031b9fe5d2cfb4a6fb45a1c424d6b92be7ba3b1aaa7c55b10f8e Persistence script, sample 5 Note: IP addresses and domains |
| sha256 | 03a1d2eca771a276ac9c29a4bf219d31beb20848998cacda8b06375bd2795b10 | ke() ClickFix variant linked to truieparth[.]online SHA-256 03A1D2ECA771A276AC9C29A4BF219D31BEB20848998CACDA8B06375BD2795B10 C2 agent SHA-256 5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a |
| sha256 | 06990ee09a29d2cdde32cb639d50e6c1e078da96a7bdabd03a68a0bb209d07b1 | a6f9e3ad69fa48233d4c805898368b2a C2 agent, sample 5 SHA-256 06990ee09a29d2cdde32cb639d50e6c1e078da96a7bdabd03a68a0bb209d07b1 Persistence script, sample 4 SHA-256 00810c2e0ad5031b9fe5d2 |
| sha256 | 10ab0f8ee0829fb24bf2c915f5bb0f35a2d84ed1d69049d42ca32cfa36250c11 | f7920f5b151e133fb68c9dfc333ec69a Persistence script SHA-256 10ab0f8ee0829fb24bf2c915f5bb0f35a2d84ed1d69049d42ca32cfa36250c11 C2 agent, sample 4 SHA-256 cf176cf0ff50c74f08f127ef3b09be63 |
| sha256 | 5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a57e6659caa14e4ac0d5939 | A4BF219D31BEB20848998CACDA8B06375BD2795B10 C2 agent SHA-256 5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a57e6659caa14e4ac0d5939 C2 agent variant SHA-256 67427f232762fe32afab1d0d14b1d6e7f7 |
| sha256 | 67427f232762fe32afab1d0d14b1d6e7f7920f5b151e133fb68c9dfc333ec69a | e0105be59f2a57e6659caa14e4ac0d5939 C2 agent variant SHA-256 67427f232762fe32afab1d0d14b1d6e7f7920f5b151e133fb68c9dfc333ec69a Persistence script SHA-256 10ab0f8ee0829fb24bf2c915f5bb0f35 |
| sha256 | cf176cf0ff50c74f08f127ef3b09be63a6f9e3ad69fa48233d4c805898368b2a | a2d84ed1d69049d42ca32cfa36250c11 C2 agent, sample 4 SHA-256 cf176cf0ff50c74f08f127ef3b09be63a6f9e3ad69fa48233d4c805898368b2a C2 agent, sample 5 SHA-256 06990ee09a29d2cdde32cb639d50e6c1 |
From the original article
5 min read at cybersecuritynews.com
A new malware campaign is using blockchain technology to keep its control servers out of reach. The operation tricks visitors to compromised business websites into running a malicious command, then steals bank logins and two-factor authentication codes. The campaign has been active since at least November 2025.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.