Evolution of Web3 in Cloud Supply Chain Attacks
Palo Alto Networks, Wednesday, October 7th, 2026
Unit 42 details how supply chain attackers now use Web3 smart contracts as resilient command-and-control to steal cloud credentials.
Unit 42 reports that threat actors have moved command-and-control from hard-coded endpoints to Web3 smart contracts, letting them update entire botnets with a single blockchain transaction.
Citing its 2026 Global Incident Response Report, it says software supply chain compromises are a leading initial access vector into enterprise cloud, with poisoned open-source packages harvesting identity tokens, service account keys and deployment secrets from developer endpoints and CI/CD pipelines.
North Korea-linked actors such as Alluring Pisces use these techniques, and Unit 42 recommends blocking unneeded Web3 traffic and automating CI/CD policy controls.