ClickFix campaigns use blockchain-powered PavinLoader to drop Amatera Stealer via fake CAPTCHAs and game installers. #Malware #PavinLoader #AmateraStealer #BlockchainC2 #ThreatIntel #Infosec https://thedailytechfeed.com/clickfix-campaigns-pavinloaders-sneaky-blockchain-c2-uncovered/
August 25, 2026 at 1:54 PM
ClickFix campaigns use blockchain-powered PavinLoader to drop Amatera Stealer via fake CAPTCHAs and game installers. #Malware #PavinLoader #AmateraStealer #BlockchainC2 #ThreatIntel #Infosec https://thedailytechfeed.com/clickfix-campaigns-pavinloaders-sneaky-blockchain-c2-uncovered/
The Dysphoria botnet uses blockchain ENS/SNS domains for covert C2 and turns victims into relays. XLab tracked over 200,000 bots in this IoT DDoS botnet.
#Dysphoria #Botnet #DDoS #IoT #BlockchainC2 #CyberSecurity
#Dysphoria #Botnet #DDoS #IoT #BlockchainC2 #CyberSecurity
Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays
At a glance Malware family Dysphoria (jackskid/fbot-derived IoT botnet) Threat actor Unattributed; run as a commercial DDoS-for-hire service Target About 200,000 IoT and embedded Linux devices worldwide, mostly routers, gateways, and IP cameras Delivery vector Telnet/SSH weak-credential brute force plus known IoT RCE exploits Key capabilities Multi-vector DDoS, blockchain ENS/SNS C2, victim-to-relay conversion, UPnP NAT traversal Source
securityonline.info
August 4, 2026 at 6:31 AM
The Dysphoria botnet uses blockchain ENS/SNS domains for covert C2 and turns victims into relays. XLab tracked over 200,000 bots in this IoT DDoS botnet.
#Dysphoria #Botnet #DDoS #IoT #BlockchainC2 #CyberSecurity
#Dysphoria #Botnet #DDoS #IoT #BlockchainC2 #CyberSecurity
The Dysphoria IoT botnet dodged law enforcement by adopting blockchain C2 to infect 239,000 devices. Naturally, our takedowns achieved absolutely nothing long-term.
#IoTBotnet #BlockchainC2
#IoTBotnet #BlockchainC2
July 28, 2026 at 6:50 AM
The Dysphoria IoT botnet dodged law enforcement by adopting blockchain C2 to infect 239,000 devices. Naturally, our takedowns achieved absolutely nothing long-term.
#IoTBotnet #BlockchainC2
#IoTBotnet #BlockchainC2
DPRK hides its macOS C2 domain inside a Polygon smart contract - seize it, they just rotate it on-chain. https://intel.threadlinqs.com/threat/TL-2026-1670 #ThreatIntel #AWS #EtherHiding #BlockchainC2
July 24, 2026 at 1:56 PM
DPRK hides its macOS C2 domain inside a Polygon smart contract - seize it, they just rotate it on-chain. https://intel.threadlinqs.com/threat/TL-2026-1670 #ThreatIntel #AWS #EtherHiding #BlockchainC2
Checkmarx exposed ViteVenom: 7 malicious npm packages in the Vite ecosystem used blockchain C2 on Tron, Aptos, and BSC to deploy a RAT for credential theft, exfiltration, and persistence. #ViteVenom #Vite #BlockchainC2
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
Checkmarx uncovered ViteVenom, a cluster of seven malicious npm packages targeting developers using the Vite frontend tooling ecosystem in a software supply chain attack. The campaign is linked to SuccessKey and ChainVeil, using a four-tier blockchain-based C2 setup across Tron, Aptos, and Binance Smart Chain to deliver a RAT for reverse...
www.hendryadrian.com
July 18, 2026 at 2:45 AM
Checkmarx exposed ViteVenom: 7 malicious npm packages in the Vite ecosystem used blockchain C2 on Tron, Aptos, and BSC to deploy a RAT for credential theft, exfiltration, and persistence. #ViteVenom #Vite #BlockchainC2