OX Security Traces PolinRider Malware's Server Hiding to Ethereum (ETH), 4 IPs Found

Server Addresses Hidden in ETH Transaction Data

Researchers at cybersecurity vendor OX Security have identified a malware campaign that hides its command-and-control server addresses inside Ethereum (ETH) blockchain transaction data, a construction that lets operators swap infrastructure without ever touching the infected software. The finding was published on November 4 in a report titled “The Return of PolinRider: Hijacked npm Packages, Ethereum Blockchain to Conceal Malware Infrastructure.” While trader attention this week sits on the Ethereum (ETH) price, the disclosure concerns a different property of the Ethereum network: its transaction ledger is public, permanent and readable by any program, which makes it a convenient hiding place. The malware at the center of the campaign is known as PolinRider. It distributes through npm, the registry where software developers download the ready-made components their applications depend on. Because such packages are pulled into countless projects, a hijacked component can carry the malware well beyond a single target. Instead of publishing fresh malicious code, the attackers hijacked packages already in legitimate circulation and embedded PolinRider into them. A developer who installs an affected package executes it on their own machine, and that machine becomes the foothold for whatever the operator decides to serve next. The unusual part is where the code looks for instructions. Conventional malware hardcodes its operator's server address into the binary itself, which gives defenders a fixed target to find and block. In a conventional operation, blocking a server forces the attacker to rebuild and redistribute the malware, a slow and costly step. PolinRider works differently: the infected program checks a specific transaction recorded on Ethereum (ETH), extracts the server address concealed in that transaction's data field, and contacts the server to download and run further malicious code. The scheme does not even require a smart contract, since ordinary transaction data is enough to carry the address. A single on-chain write replaces what would otherwise require rewriting and redistributing the malware itself.

OX Security reported that it identified one Ethereum address used in the campaign and four IP addresses of servers involved in distributing the malware, indicators that give network defenders something concrete to search their logs for. The choice of hijacked packages over newly created ones matters because established components carry trust and an existing install base, so few developers stop to question an update they have seen before. Once the malicious code is inside, the blockchain element takes over as the campaign's resilience mechanism. The chain holds no malware itself, only the pointer to it, so scanning the blockchain for suspicious payloads finds nothing obvious to remove. If a security team finds and blocks one distribution server, the operator writes a new server address into a fresh Ethereum (ETH) transaction, and every machine already infected simply reads the new entry and reconnects. Nothing on the endpoint has to change for the operation to survive, which inverts the usual balance between attacker and defender. The report also addresses the risk to the machine's owner. If the malware actually executed, OX Security recommends investigating whether crypto wallet information and login credentials stored on the affected computer were exposed, since code running on a developer workstation typically sits close to exactly those stores. The vendor does not report confirmed theft; it frames the exposure as a risk to be checked wherever execution is established. The case shows, in the researchers' summary, that ordinary software components used in development can become an attack path, and that public blockchain transaction data can be repurposed to serve malware distribution.

Reading the Blockchain as Attacker Infrastructure

The technique changes the arithmetic of takedowns. Cutting off one server buys a defender hours rather than a victory, because the operator pays a trivial gas fee to publish the next address on-chain, and data recorded on Ethereum is confirmed by validators and cannot be edited or taken down. Where a crypto mixer obscures the movement of funds, PolinRider uses the chain's transparency in the opposite direction, placing infrastructure details in plain sight where only the infected code knows to look. That leaves the endpoint as the durable line of defense: development teams need visibility into which packages run on their machines and which external addresses those packages query. OX Security's published indicators, one address and four server IPs, are the starting point for that sweep.