Malware Now Hides C2 Addresses in Smart Contracts on Ethereum, Solana, and TON
Netskope breaks down eight malware families, including the ChainDrop npm supply-chain compromise, that hide C2 addresses in smart contracts on EVM, Solana, and TON, fetched via free, traceless read-only calls like eth_call. The trick is takedown-resistant and blends into legitimate crypto RPC traffic, defeating host-only detection. Includes runnable one-liners and detection guidance.