An active campaign is deploying a JavaScript remote access trojan that impersonates 44 widely used administrative tools, targeting enterprise administrators, DevOps engineers, and security analysts through poisoned search results. The malware uses Ethereum blockchain infrastructure to resolve its command-and-control server, making traditional domain-blocking and law enforcement takedown ineffective. Every successful infection lands on a privileged account, creating immediate risk of lateral movement, credential theft, and enterprise-wide compromise.