Cybersecurity researchers have identified an evolution of the EtherHiding blockchain-based C2 technique, dubbed ‘NullReceiver.’ This method conceals the C2 server IP address within a made-up destination address of an empty Ethereum transfer. Observed in trojanized npm packages like ‘bianira-ui’ and ‘fluid-type-ui,’ this technique makes C2 discovery more difficult for defenders.