Four unrelated disclosures this week put the command-and-control rendezvous on infrastructure that resolves correctly and cannot be reputation-blocked — a public blockchain contract, the Google Sheets API, GitHub Gists, an HTTP cache header, and two thousand hijacked WordPress sites

A prior weekly carried a measurement of malware command-and-control that never asks DNS a question — traffic straight to an IP address, invisible to protective DNS, response-policy zones and sinkholing. Four disclosures this week describe the opposite arrangement and it is the harder one: the name resolves, correctly, to a service with a valid certificate and an unimpeachable reputation, because the operator has stored the actual rendezvous address inside something the estate already permits.

Red Canary's monthly round-up, published on July telemetry, is the clearest statement that this is no longer specialist tradecraft. Three of the four new entrants to its most-prevalent list resolve their command-and-control address from a dead drop rather than from a hardcoded domain or IP, and two of those read it off a public blockchain smart contract; the technique dates to first reporting in 2023, and what the round-up records is its arrival in commodity tooling, counted across three of its top ten this month (Red Canary, 2026-08-20). The mechanics decide what a defender can do about it. A macOS remote-access tool and stealer queries public Polygon RPC endpoints for a contract's stored value, decodes the response to extract a URL, and keeps messaging-platform and gaming-platform profiles as redundant dead-drop channels; a Node.js remote-access trojan polls public Ethereum RPC endpoints for a URL held at a predefined contract address; a third resolves its dead drop through a gaming-community domain or adversary-controlled hosts. Red Canary's own summary of why it matters operationally: "The technique makes traditional C2 blocking challenging, since the URL can be updated dynamically by adversaries" — the operator rewrites one contract value and every installation picks up the change with no redistribution.

The same architecture appears three more times this week on carriers that are not blockchains, which is what makes it an architectural pattern rather than a cryptocurrency story. Acronis's Threat Research Unit documents an espionage cluster running one implant's entire command-and-control through the Google Sheets API v4 using a hardcoded cloud service account and a per-victim spreadsheet tab, and a second implant doing the same job through GitHub Gists (Acronis Threat Research Unit, 2026-08-13). Bitdefender's SilkParasite disclosure records one family routing operator commands through a shared Google Drive folder and fetching in-memory plugins from it, and another using HTTP cookie and ETag header values as its command channel — a carrier that survives even a proxy inspecting request and response bodies, because the payload is in the caching metadata (Bitdefender Labs, 2026-08-19). And Check Point Research describes a criminal toolkit that dispenses with dedicated infrastructure altogether, hosting its payloads, command-and-control and stolen data on roughly 2,000 compromised WordPress sites, with persistence on each one as a must-use plugin in a directory WordPress auto-loads on every request and does not show in the plugin list (Check Point Research, 2026-08-18).

Four different carriers, one property: in each case the destination a network control can see is legitimate, and the address that matters is data held inside it, writable by the operator at will.