An Ethereum transaction is a blockchain record that transfers value or calls a smart contract. It includes fields such as the sender, recipient address, amount, and metadata. Because the record is public and standardized, malware can read it, and attackers can hide small signals inside transaction data or use the recipient address as a compact carrier for instructions.
This matters in cyber security because public blockchains can act as resilient signaling channels. Attackers may use them for command-and-control recovery, infrastructure updates, or other low-bandwidth coordination that is harder to take down than a server or domain. Defenders look for unusual blockchain parsing on endpoints, unexpected interaction with Ethereum infrastructure, and suspicious transaction patterns in environments that have no legitimate web3 use. On its own, an Ethereum transaction is not malicious; the risk comes from how it can be repurposed as covert communication.