Researchers have identified Tourmaline, a sophisticated Windows infostealer distributed via ClickFix campaigns that utilizes blockchain-based command-and-control infrastructure and DNS tunneling to evade traditional network security detection methods.

Key Points

• Tourmaline is a multi-stage Python-based backdoor delivered through fake Cloudflare "Verify you are human" browser popups.
• The malware uses an Ethereum Sepolia testnet smart contract to dynamically retrieve its command-and-control (C2) server IP address.
• Communication is disguised as legitimate Windows telemetry by tunneling traffic through custom UDP DNS queries directed at microsoft.com.
• The installer employs a time-lock XOR loader to delay execution, specifically designed to bypass automated sandbox analysis environments.
• Persistence is maintained through Windows Task Scheduler and registry modifications under the guise of a "Hardware monitoring service."

Why it Matters

The use of blockchain dead-drops for C2 resolution renders traditional IP-based blocklists ineffective, as attackers can update the infrastructure address in real-time. This sophisticated delivery and communication strategy highlights an increasing trend in malware authors leveraging decentralized networks to maintain persistent, stealthy control over compromised systems.