MetaMask is exiting affected Ethereum validators while it investigates an intrusion inside its infrastructure.
A signed security vendor binary carries an unsigned implant while blockchain smart contracts keep the command servers moving.
GoCaracal, a malware framework tied to Dark Caracal, stores a fallback C2 address on the Ethereum blockchain.