MalwarePublished 2 Nov 2026

Slaiclind: The blockchain is now a covert communication channel

Source Reddit BlueTeam

Discussion

The Slaiclind campaign uses blockchain smart contracts as covert communication channels to deliver malicious payloads. Attackers embed scripts in compromised websites that query a Polygon blockchain smart contract to retrieve URLs hosting malicious JavaScript. This technique, called EtherHiding, replaces traditional command-and-control infrastructure with blockchain storage, making detection and takedown more difficult. The campaign also employs a kill-switch mechanism controlled via the smart contract. The malicious JavaScript then uses the ClickFix technique to trick users into executing commands, advancing the infection.

r/Information_Security (opens in a new tab)u/StormshieldArgos0 points0 comments

Want to know more about the Slaidlind campaign using smart contracts to broadcast their C2 contact addresses to their malicious payload ? Read it here : Analysis of the Slaiclind Malicious Campaign

Impact

The campaign enables attackers to covertly control compromised websites by using blockchain smart contracts as a resilient and tamper-proof command-and-control channel. This allows delivery and execution of malicious JavaScript payloads that can trick users into running harmful commands, potentially leading to system compromise. The use of blockchain infrastructure makes takedown and detection more challenging, increasing the persistence and reach of the attack. The kill-switch mechanism allows attackers to remotely disable or enable the campaign, providing operational flexibility.

Defensive guidance

Since the attack relies on compromised websites embedding malicious scripts, remediation should focus on identifying and cleaning infected sites, especially those unrelated to blockchain or cryptocurrency. Monitoring for unauthorized script injections and blocking access to known malicious payload URLs can help. Network defenders should be aware of the use of blockchain smart contracts as C2 channels and consider this in threat hunting. The vendor advisory does not indicate any 'no action required' status or official fix; patch status is not applicable as this is a campaign using compromised websites rather than a software vulnerability.

Summary

Slaiclind is a malware campaign leveraging two advanced techniques: ClickFix and EtherHiding. EtherHiding involves storing attacker-controlled data immutably on blockchain smart contracts, here on the Polygon chain, which compromised websites query to retrieve payload URLs. The embedded JavaScript first checks for WordPress admin presence to avoid detection, then calls a smart contract function to get a payload list. It randomly selects a URL from this list and injects an external malicious script into the page. The smart contract includes an enabled flag acting as a kill-switch, allowing attackers to enable or disable the campaign remotely. This approach replaces traditional C2 servers with blockchain infrastructure, complicating detection and mitigation. The campaign has been active since at least late 2026 and affects a large number of compromised websites unrelated to blockchain or cryptocurrency.

References

Community reviews

Loading reviews…

Discussion

AI analysisMachine-generated, updated 2 Nov 2026, 18:28 UTC

Technical details

References

Community reviews

Related threats