EtherHiding Blockchain RPC Queries

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•8

Detects command-line parameters indicating RPC calls to Ethereum/Polygon for C2 resolution, specifically looking for 'eth_call' and known blockchain service providers like 'drpc.org', 'tenderly', 'flashbots', or 'blastapi'. This activity is indicative of the EtherHiding malware.