Cybersecurity researchers have uncovered a novel malware campaign that uses blockchain technology to conceal command-and-control (C&C) servers—making it harder for defenders to block attackers who steal bank credentials and two-factor authentication (2FA) codes. The campaign, active since at least November 2025, blends fake human-verification prompts, deceptive PowerShell commands, and a backdoor that receives updates dynamically.
How the Malware Operation Works
The malware drops its anchor on legitimate websites compromised via JavaScript injection. Visitors are duped by a fake CAPTCHA overlay when arriving from search engines. The overlay urges them to press Windows + R, paste a command, and hit Enter. This launches PowerShell commands that schedule a recurring task named “Enter.” The task periodically fetches scripts, one to ensure persistence and another to query the Polygon blockchain to learn the current server address to contact.
Unlike traditional malware that hardcodes fixed domains, these attackers deploy a smart contract on the Polygon blockchain. The malware asks the contract for the active control server address. This modular setup allows the operators to switch C&C domains through simple blockchain transactions without altering the malware code itself.
What the Backdoor Does
Once installed, the backdoor masquerades as a benign browser extension, but it’s anything but. It captures login info, 2FA codes, browser profile data, and can perform keylogging, screen capture, video capture, and even harvest data from password managers and crypto wallets. Web-inject operations are also used to target banking and cryptocurrency sites.
Researchers identified at least 31 compromised sites, 15 Polygon smart contracts, and infrastructure that spans multiple industries and countries. Despite its stealth, the campaign shows some flaws—one staging server exposed its true origin, and several sites remained active, confirming this threat is still unfolding.
Detection & Defense Strategies
Defensive teams should shift focus from domain blocklists to behavior-based indicators. Key signals include the specialized “Enter” scheduled task, anomalous PowerShell usage, paired scripts in temp folders, specific registry values like “PersonalizedUpdates,” and outbound blockchain queries.
Other recommended steps include limiting unapproved extensions, monitoring new Chrome Native Messaging registration events, treating any confirmed extension install as a potential breach, and resetting passwords for critical accounts from a clean device.
This tactic aligns with emerging trends in malware: using public infrastructure such as blockchains to make C&C servers flexible, durable, and harder to shutdown—rendering traditional reactive domain blocking increasingly ineffective.
Analysis: By using a smart contract to steer infected machines toward the right C&C server, attackers are adding layers of stealth and agility. For defenders, behavioral detection methods and architectural restrictions become vital. Monitoring scheduled tasks, registry modifications, extension activity, and blockchain queries will be key. The stakes are high—financial data, 2FA, and even crypto wallets are on the line. The true danger is the window of time this remains under the radar; early detection can make all the difference.
