Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes

A new malware campaign is using blockchain technology to keep its control servers out of reach. The operation tricks visitors to compromised business websites into running a malicious command, then steals bank logins and two-factor authentication codes.

The campaign has been active since at least November 2025. It combines a fake human-verification prompt, malicious PowerShell commands, and a backdoor that receives new instructions.

Researchers at GuidePoint Security identified the activity. Their inquiry uncovered at least 31 compromised legitimate websites, 15 Polygon smart contracts, and infrastructure that can change direction without updating the malware itself across industries in several countries over seven months.

GuidePoint Security said in a report shared with Cyber Security News (CSN) that the backdoor was later used to install a fake browser extension designed to intercept credentials and two-factor codes from roughly 479 financial and cryptocurrency sites.

It resembles ClickFix-driven ransomware access, but blockchain makes the operation more durable.

Hackers Hide Malware Servers on Blockchain

The technique is known as EtherHiding. Instead of placing a fixed command-and-control address inside the malware, the agent asks a smart contract on Polygon where it should connect.

The contract returns an encrypted address, allowing the operators to change their server with a low-cost blockchain transaction.

That design weakens a familiar defensive response: blocking a malicious domain. When an address is replaced, infected machines can obtain the next address during their next check-in, while the earlier stages remain unchanged.

Victims reach the malware through legitimate sites that attackers altered with a JavaScript injection. People arriving via Google or Bing may see a fake CAPTCHA overlay, which tells them to press Windows+R, paste a command, and press Enter.

The action looks like a verification step but launches the infection on the victim’s computer. The pasted command creates a scheduled task named Enter that repeatedly tries to retrieve the next-stage scripts.

One script establishes reboot persistence through a Windows Registry value, while the other queries Polygon and contacts the active control server.

This social-engineering path resembles the Windows Run dialog attack method, where a victim is persuaded to execute the attacker’s command rather than a browser flaw being exploited.

Banking Trojan Raises Stakes

The backdoor also delivered a browser extension that posed as legitimate software while operating as a banking trojan. It could watch users enter usernames, passwords, and two-factor codes, then use web-inject content to target bank and cryptocurrency accounts.

The extension also collected browser information and could support keylogging, screen capture, video capture, and theft from password managers and cryptocurrency wallets.

Similar extension-based theft was recently seen in the KREMLIN banking malware operation, illustrating why a browser add-on installed after a deceptive prompt deserves urgent investigation.

The infrastructure has weaknesses despite its resilience. Researchers found that one build and staging server exposed its origin address and was running seven vulnerabilities listed as actively exploited.

Some command domains and compromised websites remained live, so the campaign should be treated as ongoing rather than historical.

Security teams should focus on behavior, not only blocklists. Useful detection points include the Enter scheduled task, unexpected PowerShell activity, paired scripts in a user’s temporary folder, the PersonalizedUpdates Registry value, and outbound Polygon blockchain queries.

Teams that do not need blockchain access can block or alert on those requests, potentially stopping the malware before it learns its current server.

Organizations should also restrict unapproved browser extensions, investigate new Chrome Native Messaging registrations, and treat a confirmed extension installation as a potential credential compromise.

Passwords for banking, exchange, and other sensitive accounts used on an affected device should be reset from a clean system, while responders assess the wider environment.

The wider trend, also reflected in blockchain-based loader campaigns, shows that attackers are using public infrastructure to make short-lived domains less important and behavioral detection more important.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC