#etherhiding
2 cases
ChainScript RAT: a ClickFix-delivered trojan that hides its C2 pointer in a Polygon smart contractMalwareCryptocurrency & Web3
Blackpoint APG documented ChainScript, a full-featured RAT pushed via ClickFix lures (fake Spotify/Zoom/Teams installers) that reads a Polygon smart contract to find its live WebSocket C2 — an EtherHiding-style design built to survive takedowns and defeat indicator-based blocking.
MalwareCryptocurrency & Web3
ChainDrop and the Shai-Hulud Lineage: Anatomy of a Self-Propagating npm Supply Chain WormMalwareSupply Chain Attack
Between late 2025 and mid-2026, the software supply chain threat landscape underwent a fundamental paradigm shift with the emergence of the Shai-Hulud malware lineage. Culminating in the highly...
MalwareSupply Chain Attack