Guardio Labs, the research team at security company Guardio, writes about phishing, malicious browser extensions, ad abuse and web3-based malware.
HN commenters link it as the source for specific attack write-ups, such as EtherHiding and phishing campaigns that pass SPF, DKIM and DMARC checks.
According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform:
https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16
This diagram show the full flow of the attack:
https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4S5wz1jVZrx_gQYQZKyA.png
Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BSC), this is effectively free storage/hosting for the attacker.
The malicious code is served by BSC web API. According to the Krebs article, BSC "is aware of the malware abusing its blockchain, and is actively addressing the issue." I am not clear if they are taking this situation Very Seriously(TM), but I assume they are.
I saw one of these emails too. It was sent by an onmicrosoft.com server, linked to a phishing site, but passed SPF/DKIM/DMARC for Paypal.
Microsoft obviously isn't "forging" it. It's valid: https://labs.guard.io/echospoofing-a-massive-phishing-campaign-exploiting-proofpoints-email-protection-to-dispatch-3dd6b5417db6