EtherHiding-style Polygon eth_call C2 resolution (ChainScript)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects outbound network traffic attempting to interact with a specific Polygon smart contract address using eth_call. This behavior is indicative of the EtherHiding technique, where adversaries leverage blockchain infrastructure as a dead-drop resolver for command-and-control (C2) operations to bypass traditional network defenses.