Hackers Leverage Blockchain for Resilient C2 Servers in 'EtherHiding' Malware Campaign
A novel malware campaign dubbed EtherHiding utilizes blockchain technology on the Polygon network to host its command-and-control servers, making them highly resilient to takedowns and enabling the theft of bank logins and 2FA codes.
A sophisticated new malware campaign, identified by researchers at GuidePoint Security and named EtherHiding, is employing blockchain technology to create highly resilient command-and-control (C2) infrastructure. This innovative approach allows attackers to host their C2 servers on the Polygon network, a blockchain platform, making them exceptionally difficult to disrupt or take offline. The campaign, active since at least November 2025, has compromised over 31 legitimate websites across various industries and countries, demonstrating a wide reach and significant operational duration.
The attack chain begins with threat actors compromising legitimate websites through JavaScript injections. Visitors to these sites, particularly those arriving via search engines like Google or Bing, are presented with a deceptive "human verification" prompt, often disguised as a CAPTCHA. This prompt tricks users into executing a malicious PowerShell command by pressing Windows+R and pasting the command into the Run dialog. This social engineering tactic bypasses traditional browser exploit vectors, relying instead on user interaction to initiate the infection.
Once executed, the malicious command establishes a scheduled task named "Enter" on the victim's system. This task repeatedly attempts to download and run subsequent scripts. One script ensures persistence by creating a Windows Registry value, while another queries the Polygon blockchain to obtain the address of the active C2 server. This blockchain-based C2 mechanism is the core innovation of EtherHiding. Instead of embedding a static C2 address within the malware, the agent dynamically retrieves it from a smart contract on the Polygon network.
This method offers significant advantages for the attackers. By using a smart contract, they can change the C2 server address with a simple, low-cost blockchain transaction. This circumvents a common defensive strategy of blocking malicious domains, as infected machines can simply fetch the updated address during their next check-in. The resilience of the blockchain infrastructure ensures that even if one C2 server is identified and blocked, the malware can quickly pivot to a new one without requiring an update to the malicious code itself.
Following the establishment of C2 communication, the EtherHiding backdoor deploys a malicious browser extension. This extension is designed to impersonate legitimate software while functioning as a potent banking trojan. It actively monitors user activity, capturing usernames, passwords, and two-factor authentication codes entered on approximately 479 targeted financial and cryptocurrency websites. The extension also possesses capabilities for broader data theft, including collecting browser information, performing keylogging, capturing screenshots and video, and exfiltrating data from password managers and cryptocurrency wallets.
Despite the resilience offered by blockchain, the campaign is not without its weaknesses. GuidePoint Security researchers identified vulnerabilities in the attackers' infrastructure, including a build and staging server running seven actively exploited vulnerabilities. While some C2 domains and compromised websites remain active, indicating an ongoing threat, these infrastructure flaws could potentially be exploited for detection or disruption.
To defend against EtherHiding, security teams are advised to focus on behavioral detection rather than solely relying on blocklists. Key indicators include the "Enter" scheduled task, unusual PowerShell activity, paired scripts in temporary folders, the "PersonalizedUpdates" Registry value, and outbound queries to the Polygon blockchain. Blocking or alerting on these Polygon queries can be an effective way to halt the malware before it establishes C2 communication. Additionally, organizations should restrict unapproved browser extensions, monitor for new Chrome Native Messaging registrations, and treat any confirmed extension installation as a potential credential compromise.
The EtherHiding campaign exemplifies a growing trend where threat actors leverage public, resilient infrastructure like blockchains to enhance the survivability of their malware operations. This shift underscores the increasing importance of behavioral analysis and proactive defense strategies in combating advanced persistent threats.