Blockchain-hosted payloads are malware delivery methods that store the payload itself, or a reference to it, on blockchain infrastructure such as a smart contract, transaction field, or decentralized content layer instead of a normal web server. The blockchain is not used because it is faster; it is used because it is distributed, durable, and difficult to remove.
This matters in cyber security because it gives attackers a resilient way to stage malware, rotate locations, and avoid simple takedown or blocklist tactics. In real attacks, a script or lure page may query a chain-based record, recover an encrypted blob or download URL, and then launch a second-stage infostealer or loader. Defenders look for unusual blockchain API calls, browser or script activity that resolves hidden payloads, and endpoint behavior that follows a suspicious on-chain lookup. Monitoring these indirect fetches can reveal the attack before the final payload runs.