OTX Threat: EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight

A sophisticated malware campaign active since November 2025 exploits blockchain technology to maintain persistent command-and-control infrastructure. Attackers store C2 addresses in Polygon blockchain smart contracts rather than hardcoding them, enabling rapid infrastructure rotation for pennies. The operation compromised at least 31 legitimate websites across multiple countries, deploying FakeCap CVEs: CVE-2023-0386, CVE-2023-44487, CVE-2023-4911, CVE-2024-6387 Sectors: Finance