EtherHiding shifts malware control to Polygon blockchain

A malware campaign using the EtherHiding technique has exploited the Polygon blockchain to conceal and dynamically rotate command-and-control infrastructure while stealing banking and cryptocurrency credentials from infected users.

Security researchers tracing the operation said it has been active since at least November 2025 and has compromised at least 31 legitimate business websites across several countries and industries. The campaign has evolved from deploying a general-purpose PowerShell backdoor into delivering a browser-based banking trojan capable of intercepting login credentials and two-factor authentication codes.

The operation uses Polygon smart contracts as an address book for malware infrastructure. Instead of embedding a fixed command-and-control domain inside the malicious code, infected machines query a hardcoded smart contract through public blockchain gateways. The contract returns an encrypted domain, which the malware decodes before connecting to its operators.

That design allows the attackers to change the server used by already infected machines by updating the smart contract, without altering malware installed on victims’ computers. Researchers said the mechanism makes conventional domain takedowns and blocklists less effective because a replacement address can be pushed to every compromised device through a blockchain transaction.

GuidePoint Security, which reconstructed the campaign during an investigation into a business email compromise, identified 15 smart contracts deployed in six operational waves over seven months. Two operator wallets were linked to the infrastructure, with one wallet deploying the first known contract on November 2, 2025. Three previously unreported C2 domains were identified, alongside 12 contracts designed to frustrate enumeration by researchers.

The researchers said the compromised websites included businesses in sectors such as e-commerce, professional services and retail logistics. Malicious JavaScript injected into legitimate pages directed selected visitors through a traffic-distribution system to a fake human-verification prompt associated with the ClickFix social-engineering technique.

Victims who followed the instructions were prompted to open the Windows Run dialogue and paste a command. That action created a scheduled task and downloaded PowerShell scripts, including a command-and-control agent and a persistence component designed to survive system reboots.

The command-and-control agent contained a list of nine public Polygon remote procedure call endpoints. It cycled through those gateways if one failed, queried the smart contract and retrieved the latest server address. Researchers said the use of multiple public endpoints added another layer of resilience to the operation.

Once connected, the backdoor could execute PowerShell commands sent by the operators and identify victims using information derived from the Windows MachineGuid, hostname and username. The malware also established persistence through a Windows registry key after initially using a scheduled task.

The campaign later expanded to deliver a malicious browser extension operating as a real-time banking trojan. GuidePoint said the extension was configured against roughly 479 financial and cryptocurrency domains and could display web-inject panels designed to capture credentials and authentication codes as users entered them.

Analysis of the extension also identified capabilities for keylogging, screenshots, video capture, theft from password stores and collection of browser data. The researchers said confirmed installation of the extension should be treated as a potential credential-compromise incident because banking or exchange credentials entered afterwards could have been exposed.

Independent research has documented similar abuse of blockchain infrastructure. Cribl researchers described an EtherHiding campaign in August that used Polygon smart contracts to obscure and rotate command-and-control addresses after malicious code was planted on a compromised WordPress site. Google threat researchers have separately documented EtherHiding in campaigns involving North Korea-linked operators, although no such attribution has been established for the specific Polygon campaign examined by GuidePoint.

The Canadian Centre for Cyber Security has also warned that EtherHiding can be used to conceal malware infrastructure by storing or retrieving malicious information through public blockchains. Its analysis described attackers using blockchain-linked delivery chains to maintain access and execute further payloads.