Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials

Cybersecuritynews •Tushar Subhra Dutta • October 8, 2026

Threat actors are increasingly turning public blockchain networks into a command-and-control (C2) layer for software supply chain malware, helping them rotate infrastructure without changing the malicious code already running on developer systems. The method gives criminals a resilient way to direct infected packages toward new data-theft servers while making traditional domain blocklists less effective. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Blockchain C2 Malware Targets Cloud Credentials in Supply Chain Attacks Recent campaigns involving the ChainDrop npm worm and the PolinRider operation have exploited blockchain networks as command-and-control (C2) infrastructure to steal cloud credentials from developer environments. These malware variants utilize poisoned open-source packages to harvest sensitive tokens, including OpenID Connect tokens and CI/CD secrets, from compromised systems. ChainDrop has infected over 400 npm packages, including popular dependencies, and can propagate itself through stolen npm publishing tokens. The malware employs advanced techniques such as querying Ethereum smart contracts for C2 details, enabling attackers to rotate their infrastructure without altering the malware code. The PolinRider operation demonstrates similar tactics across a broader developer ecosystem. Researchers emphasize the challenge of defending against these threats due to the dynamic nature of blockchain C2, which complicates traditional domain blocking methods. 2 sources 68

Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)