🎯 Blockchain-based C2 resolution

The items that name it 3

• Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads
  article2026-10-08

  Overlord RAT uses a novel Solana blockchain-based C2 resolver to dynamically locate command-and-control infrastructure, making takedown significantly more difficult

• MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
  article2026-09-30

  Overlord RAT variant uses the Solana blockchain to retrieve updated C2 server addresses

• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  writeup2026-07-30

  Reads a Tron transaction, follows it to a BNB Smart Chain transaction via eth_getTransactionByHash, decodes and XOR-decrypts the input and evaluates it as JavaScript; Aptos account used as fallback pointer, allowing C2 rotation without hardcoding a server