ClickFix lures deliver Phexia malware that hides C2 via Polygon contracts
Phexia operators rotate C2 addresses by updating smart contracts; defenders should hunt Terminal commands and LaunchAgents.
Stories per day · 30 days
3 RSS
8 stories, newest first · one card per story
Stories tagged #blockchain-c2
DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware
DPRK-linked hackers added Ethereum HashHiding so malware can recover C2 addresses from ordinary transfers.
2
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
Malicious B-tree NPM Package Accumulates Millions of Downloads
Ongoing NPM supply chain campaign hides malware in indexed-btree's prototype code, reaching 2 million weekly downloads before detection.
1
GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package
GHAPPIER supply chain campaign compromised 65 GitHub repositories and pushed a malicious four-stage npm loader via compromised maintainer trusted publishing.
Hackers Poison Movie Torrents With MovieReaper Malware That Uses Solana for C2
Poisoned movie torrents deliver MovieReaper malware using Solana blockchain for resilient C2, infecting several hundred victims across multiple continents.
4
MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2
Kaspersky reports MovieReaper malware distributed via compromised torrent repository itorrents.org, using Solana blockchain for resilient C2 across four continents.
2
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
2