# EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials

> A campaign active since at least November 2025 has compromised 31 legitimate business websites and rotated 15 Polygon smart contracts across six operational waves to resolve command-and-control infrastructure, evolving from a PowerShell backdoor into a real-time banking trojan and malicious browser extension that intercepts credentials and 2FA codes across roughly 479 targeted financial and cryptocurrency domains.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2600
- **ID:** TL-2026-2600
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EtherHiding is a technique first documented by Guardz in October 2023, in which adversaries host a pointer to their live command-and-control (C2) infrastructure inside a public blockchain smart contract rather than hardcoding it into malware, letting operators rotate C2 domains via a cheap on-chain transaction instead of re-deploying payloads. The technique was originally observed on Binance Smart Chain in the ClearFake fake-browser-update campaign. GuidePoint Security's DFIR team documented a distinct, Polygon-based evolution of the technique active since at least November 2025, in which victims of at least 31 compromised legitimate business websites (e-commerce, professional services, and retail-logistics operators) are shown a fake CAPTCHA / 'ClickFix' overlay instructing them to press Win+R and paste a PowerShell one-liner, which downloads a PowerShell backdoor from an attacker-controlled '.fun'/'.xyz'/'.online' delivery domain.

Once running, the backdoor performs a free, read-only `eth_call` against a hardcoded Polygon smart contract (observed contracts include 0xde2d34339c279a7a79bc4fc1c4f37d3c055211b7 and sibling 0xa982e044217b6bbaa7b3123b670c1c0ca1138a37, controlled by operator wallets 0xd802C9427ce416B9DAb2db5aDD76EfAA6d9d826a and 0x6a6e177dcf992ac16f7367c14b26a3cf4775dfde), using any of nine hardcoded public Polygon RPC endpoints for redundancy. The contract's return data is an obfuscated string that decodes, via a custom XOR cipher (key `!sdf$&G321`), to the current live C2 domain -- letting the operators rotate active C2 (observed: hivinest.online, insinght.site, 3262d48df5d75e34.shop, ddcd62e16a428c8e.shop, dsgnfwd.xyz, hubcreative.shop) at will while the malware binary and delivery chain stay unchanged. Across the campaign's seven-month lifespan the operators deployed 15 such contracts over six operational waves.

The implant establishes persistence via an HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry value named 'PersonalizedUpdates' and a Scheduled Task named 'Enter' that re-executes the loader roughly every 60 seconds (the task is subsequently deleted by the malware to reduce forensic footprint). It fingerprints each victim by combining the Windows MachineGuid (HKLM\SOFTWARE\Microsoft\Cryptography), hostname, and username into a victim ID, and communicates with C2 over HTTP using the Authorization header as a covert data channel.

Over the campaign's lifetime the payload evolved from a general-purpose PowerShell remote-access backdoor into a real-time banking trojan, and operators added a fake malicious browser extension (extension ID bpknfkhjjbjgagobdaekmnlgdhbbpcea, communicating via native messaging host `com.top.index`) that intercepts banking and cryptocurrency-exchange login credentials and 2FA/OTP codes as victims type them, targeting an estimated 479 financial-services and cryptocurrency domains via web-inject-style interception panels (observed: purplepencel.online, detsigen.site). One piece of staging infrastructure identified in the investigation, onemm.net (origin IP 37.27.52.152), was itself found running seven CISA KEV-listed vulnerabilities, including CVE-2024-6387 (regreSSHion), indicating opportunistic infrastructure reuse rather than hardened operator tradecraft.

GuidePoint Security's public disclosure notes that the blockchain's immutability cuts both ways: while it lets operators cheaply rotate C2 without redeploying malware, every contract-update transaction is permanently and publicly recorded, letting defenders reconstruct the full operational timeline and pivot from one wallet or contract to related infrastructure. GuidePoint did not attribute the campaign to a named threat actor or group; the credential-theft focus and banking/crypto targeting indicate a financially motivated cybercriminal operation. Separately, GuidePoint and other researchers note the broader EtherHiding technique itself (independent of this specific Polygon campaign) has since been adopted by North Korea-linked state actors (from late 2025) and Iran-linked groups (from early 2026), reflecting wider tradecraft diffusion of blockchain-based C2 resolution across the threat landscape.

## MITRE ATT&CK

- T1584.006 Web Services
- T1608.004 Drive-by Target
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1176.001 Browser Extensions
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1056.004 Credential API Hooking
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1008 Fallback Channels

## Sources

- [EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials](https://gbhackers.com/etherhiding-malware-attack/)
- [EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight](https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/)
- [EtherHiding Exposed: What Security Leaders Need to Know](https://www.guidepointsecurity.com/blog/etherhiding_exposed_what_security_leaders_need_to_know/)
- [EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight (reprint)](https://securityboulevard.com/2026/09/etherhiding-exposed-inside-a-blockchain-powered-malware-campaign-hiding-in-plain-sight/)
- [EtherHiding Exposed: What Security Leaders Need to Know (reprint)](https://securityboulevard.com/2026/09/etherhiding-exposed-what-security-leaders-need-to-know/)
- [Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign](https://thehackernews.com/2023/10/binances-smart-chain-exploited-in-new.html)
- [EtherHiding: A Novel Technique to Hide Malicious Code Using Binance's Smart Chain](https://cybersecuritynews.com/etherhiding-a-novel-technique-to-hide-malicious-code/)
- [Cribl SecOps uncovers EtherHiding malware campaign on the blockchain](https://cribl.io/blog/cribl-secops-uncovers-etherhiding-malware-campaign-on-the-blockchain/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2600