A zero-value Ethereum transaction is a blockchain transaction that sends no ETH, but still records metadata such as the recipient address and optional input data. Because the transaction is public and immutable, attackers can abuse it as a covert signaling channel without moving funds.
In cyber security, this matters because malware can watch the chain for a specific pattern or payload and use it to learn where to connect next, fetch fresh command-and-control details, or rotate infrastructure. That makes static blocklists and hardcoded indicators less effective. Defenders should treat unusual use of public blockchain data as a clue, especially when it appears alongside suspicious software installs, build-time network activity, or new outbound connections that do not match normal business behavior.