buildOne report1 publisher Chainalysis says blockchain-assisted cyberattacks, driven mostly by North Korean and Iranian state actors, have risen more than fivefold since last year. The malware reads server addresses or code from public chains, and no seizure or hosting takedown can delete those records.
Reality
- Evidence40
- Adoption40
- Hype gap+20
- Incentives50
- Confidence45
Chainalysis says writes of malware instructions to public blockchains have climbed from about 2.06 a day to 11.1 since July 2025, with groups tied to North Korea and Iran behind most of the increase. Its research lead could not confirm AI models helped.
Reality
- Evidence42
- Adoption48
- Hype gap+30
- Incentives68
- Confidence40
Prophet Security investigated every alert in its customers' environments from May through July and found account takeovers turned on how the intruder arrived, with stolen passwords usually stopped and stolen sessions running for weeks.
Reality
- Evidence34
- Adoption30
- Hype gap+18
- Incentives82
- Confidence52
Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.
Reality
- Evidence68
- Adoption38
- Hype gap−12
- Incentives55
- Confidence60
The lure is a fake leaked vulnerability report promising 38% higher payouts to anyone greedy enough to paste the code. The command channel is a public Google Sheet that Talos reported twice and that stayed up.
Reality
- Evidence64
- Adoption68
- Hype gap−8
- Incentives62
- Confidence60
SOCRadar says two previously unreported RATs pull their next-stage commands out of FTP greetings. It is a first in the wild, and noisier than the web dead drops it replaces.
Reality
- Evidence60
- Adoption38
- Hype gap+12
- Incentives58
- Confidence55