BLOCKCHAIN DEAD DROP RESOLVERS EXPLAINED

Summary from the TLDR InfoSec newsletter

Researchers identified multiple malware families abusing smart contracts on EVM, Solana, and TON blockchains as "dead drop resolvers" to dynamically fetch command-and-control addresses. By utilizing read-only functions like eth_call, threat actors can cheaply rotate infrastructure without altering their core payloads, a tactic recently deployed in the August 2026 ChainDrop npm supply-chain compromise. To detect this evasion technique, defenders should monitor for non-browser processes like node, bun, or curl making anomalous RPC queries to public providers and correlate the decoded responses.