Technique that stores malicious code or C2 instructions inside blockchain smart contracts, letting malware fetch commands from public chains instead of servers.
Unit 42 says supply-chain attackers have moved command-and-control into blockchain smart contracts, so one transaction can re-point an entire botnet or worm. Defenders' useful choke points are now developer machines, CI runners and the chain lookup itself.
Reality
Chainalysis says blockchain-assisted cyberattacks, driven mostly by North Korean and Iranian state actors, have risen more than fivefold since last year. The malware reads server addresses or code from public chains, and no seizure or hosting takedown can delete those records.
Reality
Malware that steals a developer's Git credentials force-pushes a poisoned vite.config.js to every reachable branch, a dozen rewritten in a minute in one case. A routine git pull and build then runs it, and dependency scanners never see the change.
Reality
CTM360 tracked more than 17,000 compromised URLs serving a fake Cloudflare check whose next hostname arrives from an on-chain lookup. Microsoft put 47 percent of its 2025 initial-access cases down to the technique.
Reality
McAfee says the WeedHack stealer's control server is dead and its renter dashboard gone, but ten impersonation sites and the search rankings behind them are still delivering victims.
Perspective Coverage
3 publishersReality
Checkmarx says a fake sorted-btree clone reached 2 million weekly downloads with clean install scripts, starting its loader only when an application calls BTree.prototype.set with a particular key. Nine related packages have been pulled.
Perspective Coverage
3 publishersReality
Sekoia's comparison found the two ClickFix services' injected scripts near identical, while the Exvicy subscription climbed from $1,200 to $2,000 a month and its panel count reached about 80 hosts by late August.
Reality
Chainalysis says writes of malware instructions to public blockchains have climbed from about 2.06 a day to 11.1 since July 2025, with groups tied to North Korea and Iran behind most of the increase. Its research lead could not confirm AI models helped.
Reality
Huntress and BleepingComputer describe sponsored ads that land on a real Claude Artifact page. The download link and the pasted curl command both reach elsewhere, so the trusted hostname never serves the payload.
Reality
The lure is a fake leaked vulnerability report promising 38% higher payouts to anyone greedy enough to paste the code. The command channel is a public Google Sheet that Talos reported twice and that stayed up.
Reality
Compromised WordPress and PrestaShop pages fetch their next stage with a JSON-RPC eth_call to BNB Smart Chain Testnet, so the artefact sitting on the site is a request, not a file you can quarantine.
Reality
The Threat Hunter Team says the technique has hit government departments, technology firms and hotels since February 2026. In one case, the operators moved to node.exe only after their Cobalt Strike beacons kept getting blocked.
Reality
A dropper committed straight into repos executes from .vscode/tasks.json the moment VS Code opens the project, and resolves its server from an Ethereum transaction. One sample sat five months.
Reality
Malwarebytes traces one loader through ClickFix prompts, malicious game installs and fake software downloads. The shared part is a .csproj-to-MSBuild handoff and a blockchain lookup for C2.
Reality