#etherhiding — Public Fediverse posts

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Indicators extracted from public reporting. Source: https://thehackernews.com/2026/08/threatsday-ghostjacking-ai-attacks.html

Pulse ID: 6a82e8c643a97c16c112fc63
Pulse Link: https://otx.alienvault.com/pulse/6a82e8c643a97c16c112fc63
Pulse Author: CyberHunter_NL
Created: 2026-08-17 10:56:06

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EtherHiding #HTML #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RCE #bot #CyberHunter_NL

Tracking Shai-Hulud: Inside the ChainDrop NPM Worm

On August 4, 2026, ChainDrop, a self-propagating worm variant of Mini Shai-Hulud linked to TeamPCP, infiltrated the npm ecosystem through a compromised maintainer account of the keyv ecosystem. The attacker injected malicious code into GitHub repositories, weaponizing legitimate CI/CD pipelines to publish poisoned packages with valid SLSA Build Level 3 provenance attestations, making them indistinguishable from clean releases. ChainDrop spread to over 400 packages within four hours by stealing npm tokens and republishing infected versions. The worm employs Ethereum smart contracts for C2 infrastructure, enabling domain rotation without modifying deployed malware. It features destructive capabilities, wiping victim home directories upon token revocation, and achieves persistence through IDE and AI-agent configuration files. The payload harvests credentials from npm, GitHub, AWS, Azure, GCP, Kubernetes, HashiCorp Vault, and other services, exfiltrating data via GitHub repositories and EtherHiding techniques.

Pulse ID: 6a7bdb4167c384aad06f1253
Pulse Link: https://otx.alienvault.com/pulse/6a7bdb4167c384aad06f1253
Pulse Author: AlienVault
Created: 2026-08-12 02:32:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AWS #Azure #CyberSecurity #ELF #EtherHiding #GitHub #InfoSec #Malware #NPM #OTX #OpenThreatExchange #RAT #Worm #bot #AlienVault

How the ErrTraffic Malware Campaign Uses ClickFix and EtherHiding

Pulse ID: 6a7bf867289c58f920af5e9b
Pulse Link: https://otx.alienvault.com/pulse/6a7bf867289c58f920af5e9b
Pulse Author: Tr1sa111
Created: 2026-08-12 04:36:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EtherHiding #InfoSec #Malware #OTX #OpenThreatExchange #bot #Tr1sa111

How the ErrTraffic Malware Campaign Uses ClickFix and EtherHiding

WatchGuard Threat Lab identified an active malware-as-a-service campaign leveraging ErrTraffic framework to distribute multiple threats through compromised WordPress websites. The operation employs ClickFix social engineering techniques and EtherHiding, which uses Polygon blockchain smart contracts to conceal command-and-control infrastructure dynamically. The campaign delivers various threats including Vidar infostealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader through multiple delivery methods such as DLL side-loading, process injection, and reflective loaders. Attackers exploit legitimate Windows binaries as LOLBINs, perform anti-analysis checks, create remote threads in browsers to bypass security features like Chrome's Application-Bound Encryption, and utilize various evasion techniques including code virtualization and RunPE. The framework is advertised by user LenAI on cybercrime forums and incorporates a Traffic Distribution System enabling affiliates to monetize victims...

Pulse ID: 6a7b3ff969397d537e5d24fa
Pulse Link: https://otx.alienvault.com/pulse/6a7b3ff969397d537e5d24fa
Pulse Author: AlienVault
Created: 2026-08-11 15:30:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #Chrome #CyberCrime #CyberSecurity #Encryption #EtherHiding #InfoSec #InfoStealer #Malware #MalwareAsAService #OTX #Onion #OpenThreatExchange #RAT #RDP #SocialEngineering #Vidar #Windows #Word #Wordpress #bot #AlienVault

Hackers Hide Malware Infrastructure on Polygon Blockchain and Trick Users Into Running It With ClickFix

Indicators extracted from public reporting. Source: https://www.watchguard.com/wgrd-security-hub/secplicity-blog/errtraffic-malware-campaign-clickfix-and-etherhiding

Pulse ID: 6a7b1be1f771096bdb98e961
Pulse Link: https://otx.alienvault.com/pulse/6a7b1be1f771096bdb98e961
Pulse Author: CyberHunter_NL
Created: 2026-08-11 12:56:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #CyberSecurity #EtherHiding #HTTP #HTTPS #InfoSec #Malware #OTX #OpenThreatExchange #RCE #bot #CyberHunter_NL

🕵🏻 Comment les cyberattaquants détournent-ils la #blockchain pour masquer leurs attaques ? 🔎
Découvrez dans le nouvel article #CTI Stormshield une analyse de la technique #EtherHiding, de ses limites et des moyens de détection.

➡️ https://www.stormshield.com/fr/actus/cti-etherhiding-technologie-blockchain/?at_medium=social&at_campaign=cti-etherhidhing&at_platform=Mastodon #cybersécurité #ThreatIntel

Fake AI Tools Deliver Infostealer

In April 2026, a Malware-as-a-Service NodeJS infostealer campaign evolved its delivery methods, shifting from ClickFix social engineering to weaponized GitHub repositories. Attackers clone legitimate AI-related repositories and developer tools, subtly embedding malicious payloads that target developers and AI users. The campaign employs SmartLoader in a redundant two-stage loader chain, with both stages using EtherHiding to resolve C2 addresses from Polygon blockchain smart contracts at runtime. This technique enables operators to redirect all implants by updating blockchain values without code modification. The first stage uses Prometheus-obfuscated Lua scripts, while the second stage likely uses MoonSec obfuscation. Victims are primarily located in North America, Asia, and Southern Europe, with financial services, banking, and technology sectors most affected. The campaign delivers various infostealers including previously documented NodeJS variants, specifically targeting developers' elevated privileges...

Pulse ID: 6a722d8d66f65b167764ad69
Pulse Link: https://otx.alienvault.com/pulse/6a722d8d66f65b167764ad69
Pulse Author: AlienVault
Created: 2026-08-04 18:21:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #Bank #BlockChain #CyberSecurity #EtherHiding #Europe #GitHub #InfoSec #InfoStealer #LUA #Malware #MalwareAsAService #NorthAmerica #OTX #OpenThreatExchange #RAT #SocialEngineering #SouthernEurope #bot #developers #AlienVault

Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

Between July 21-22, 2026, 29 organizations were compromised through a sophisticated malvertising campaign exploiting Claude AI's legitimate domain. Victims searching for Claude Desktop via Bing encountered sponsored advertisements leading to a malicious Claude Artifact hosted on the authentic Claude.ai domain. This artifact redirected users to attacker-controlled infrastructure distributing a fake ClaudeDesktop.exe file containing SectopRAT. The malware employed advanced anti-analysis techniques including VMProtect packing, GPU-based virtual machine detection, and DirectX shader-based payload decryption. Command-and-control infrastructure utilized EtherHiding, storing C2 addresses in Ethereum blockchain transactions for resilience against takedowns. The remote access trojan exfiltrated credit card data, credentials, browser information, and personal files. Analysis revealed connections to previous campaigns dating to December 2025, with infrastructure linked to Operation Endgame seizures and StealC distrib...

Pulse ID: 6a616004250472ee87e19829
Pulse Link: https://otx.alienvault.com/pulse/6a616004250472ee87e19829
Pulse Author: AlienVault
Created: 2026-07-23 00:27:48

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #CreditCard #CyberSecurity #EtherHiding #InfoSec #Mac #Malvertising #Malware #OTX #OpenThreatExchange #RAT #RemoteAccessTrojan #Stealc #Trojan #Troll #bot #AlienVault

If you pirate games, you should expect malware. That's a tale as old as 1970-01-01T00:00:00.000Z. But using Etherhiding as the second stage source? Well that's slightly newer.

In case you couldn't tell, we're declaring war on #Etherhiding. More to come.

https://discourse.ifin.network/t/pirated-games-come-with-a-side-of-amatera-stealer/675

#ThreatIntel #ThreatIntelligence #IFIN

@CatherineFlick

The website wavesandwild[.]com was compromised with the ClickFix social engineering technique to trick victims into executing malicious commands injected into their clipboard which installs and runs NetSupport RAT, a remote access tool. NetSupport RAT is based on NetSupport Manager, a legitimate tool which is frequently used by bad actors for malicious purposes. NetSupport Manager, used maliciously or otherwise, provides full and complete control over the victim’s device. Once the client has been installed, attackers can access, acquire, and manipulate any data on the device (exfiltrate data, execute additional payloads).

The gory (and potentially boring) technical details are as follows. I wanted to share these details for folks like me who track and monitor ClickFix attacks. Do NOT visit or interact with any of the below content. Thanks for sharing this attack!

———————————

Full Attack Chain:
wavesandwild[.]com (compromised site)
--> POST polygon.publicnode[.]com/polygon.drpc[.]org to perform transaction lookup for next domain: "to": "0x6300d82A6e2fabbd165E1833d95E87bD46B38D4A", "data": "0xe00fe2eb" (aka 'EtherHiding')
--> Download and process content on hxxps://sentrydb[.]org/track.php
--> Load victim's clipboard, display ClickFix splash screen
--> Victim copy and pastes malicious obfuscated command to their clipboard
--> powershell downloads and executes feinmotorik.geschenkideen-die-foerdern[.]de/index.html
--> Retrieves feinmotorik.geschenkideen-die-foerdern[.]de/clik.txt
--> Extracts and XOR-decrypts an embedded blob within the PNG file 'clik.txt'
--> Installs and runs NetSupport RAT using embedded configuration files
--> C2 communication established with 216.158.95[.]180:443, tamweelke[.]com:443, or bcrfix[.]com:443
--> Host reconnaissance command results (OS, username, date, application name (SecurityHealth), computer name, IP details) sent to hxxp://172.245.25[.]134:8787/collect, likely for victim prioritization efforts

IOCs
wavesandwild[.]com - Compromised website (ClickFix)
polygon.publicnode[.]com - RPC domain lookup
polygon.drpc[.]org - Fallback RPC domain lookup
0x6300d82A6e2fabbd165E1833d95E87bD46B38D4A - wallet address containing the next stage
hxxps://sentrydb[.]org/track.php - Domain retrieved via the RPC lookup which filters victims based on response and if passes checks, delivers the ClickFix command to be pasted into the victim's clipboard
feinmotorik.geschenkideen-die-foerdern[.]de/index.html - URL in obfuscated ClickFix powershell command
feinmotorik.geschenkideen-die-foerdern[.]de/clik.txt - additional URL contacted containing the PNG file with the embedded, encrypted NetSupport RAT
ip-api[.]com/json/?fields=query,country,city - IP address lookup for victim
hxxp://172.245.25[.]134:8787/collect - Exfiltrated recon data destination stolen from victim's host
216.158.95[.]180:443 - NetSupport RAT gateway address
tamweelke[.]com:443 - NetSupport RAT gateway address
bcrfix[.]com:443 - Secondary NetSupport RAT gateway address
CH-124FF74C - index string, potential campaign ID?
29b68bb454600b0abd1aad1f861bd11f28cd6cf9cd39cec53cc36
275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792 - SecurityHealth.exe (NetSupport RAT)

Interesting findings:
The error messages in the final Powershell script block are in Russian.
The embedded index string is CH-124FF74C (campaign identifier?).
Each stage listed above was heavily obfuscated, making reverse engineering analysis extremely tedious and time-consuming.
The malware attempts to remove all entries from the RunMRU registry key to hide the ClickFix execution evidence.
Clik.txt is not actually a TXT file but rather a PNG file which contains an embedded malicious blob along with the XOR key to decrypt and run the NetSupport RAT.
Sekoia calls this IClickFix - https://www.sekoia.com/blog/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic

#clickfix #etherhiding #netsupportrat #netsupportmanager #malware #reverseengineering

RE: https://infosec.exchange/@briankrebs/116780029181293028

Heads up, Gizmodo has been compromised by some #ErrTraffic affiliate to. Inject is in main response.
ErrTraffic C2 cdnpro-987[.]xyz (Resoved via #EtherHiding)
PS Payload domain cdnportal-us[.]xyz (dynamic PowerShell command URI path)
PowerShell downloads a 16MB encrypted 7z file, checks if 7z is installed and otherwise downloads it to unpack the file and run the contained EXE. The EXE will do some profiling (including refresh rate) and if passes, will drop #NetSupportRAT and run it.
NetSupport C2 178[.]16[.]55[.]191.

TA also has a Mac payload configured, but it seems broken at the moment and ask for a password of some zip file when executed 🤷

Note: ErrTraffic is a ClickFIx-as-a-Service, so other compromised sites can lead to other malware from other affiliates.

Une méthode inédite, baptisée « #EtherHiding », transforme la #blockchain de #cryptomonnaies #Ethereum en arsenal offensif. Les #chercheurs en #cybersécurité de #Google tirent la sonnette d' #alarme face à cette escalade #technologique

https://www.futura-sciences.com/tech/actualites/cybersecurite-blockchain-nest-plus-sure-ce-piratage-venu-coree-nord-inquiete-k2m6-131599/

EtherHiding emerges as a malware delivery mechanism!

Google threat intelligence is reporting North Korean nation-state actor "UNC5342" is leveraging transactions on public blockchains to store and retrieve malicious payloads.

EtherHiding executes a social engineering campaign (fake job interviews, crypto games) as the initial compromise to lure developers — often those working in the cryptocurrency or tech industries — into downloading malware disguised as job-related files or coding challenges.

Once a target opens the file, a malicious script connects to a public blockchain like BNB Smart Chain or Ethereum, to retrieve encrypted code from a smart contract. That code installs a JadeSnow loader, which in turn delivers a more persistent backdoor known as InvisibleFerret that has been used in multiple cryptocurrency thefts.

https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding #Security #CyberSecurity #Hackers #CyberAttack #UNC5342 #Google #Malware #SmartContracts #Crypto #CryptoCurrency #EtherHiding #SocialEngineering #BlockChain

North Korean state-sponsored hackers are embedding malware within public blockchains to steal cryptocurrency, a technique called "EtherHiding." Malicious JavaScript payloads are hidden inside smart contracts, making them effectively unremovable.
Read more: https://www.tomshardware.com/tech-industry/cyber-security/north-korea-hiding-malware-inside-blockchain-smart-contracts
#Cybersecurity #Malware #NorthKorea #Hacking #Blockchain #Crypto #Cryptocurrency #EtherHiding #SmartContracts #CyberAttack #TechNews

#NorthKorea|n #hackers, tracked as #UNC5342, are using the #EtherHiding technique to hide #malware on the #blockchain. This technique, first described by Guardio Labs, allows the threat actor to host #maliciousscripts within #smartcontracts on the Binance Smart Chain or Ethereum, making it difficult to track and disrupt campaigns. https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/?eicker.news #tech #media #news

North Korean Hackers Use ‘EtherHiding’ to Spread Malicious Crypto Wallets, Mandiant Warns - TLDR:

DPRK hackers use EtherHiding to embed malicious scripts within blockchain smart co... - https://blockonomi.com/north-korean-hackers-use-etherhiding-to-spread-malicious-crypto-wallets-mandiant-warns/ #blockchainsecurity #binancesmartchain #wordpressattacks #cryptophishing #cryptowallets #cybersecurity #dprkhackers #etherhiding #security #mandiant #crime #apt43

North Korean hackers are taking stealth to a new level: embedding malware into blockchain smart contracts and tricking devs with fake job interviews. Are we ready for a world where your next code review could be a trap?

https://thedefendopsdiaries.com/north-korean-hackers-leverage-etherhiding-malware-distribution-via-blockchain-smart-contracts/

#etherhiding
#northkoreanhackers
#blockchainsecurity
#malwaredistribution
#smartcontracts
#cyberthreats
#socialengineering
#infosec

TDR analysts published an analysis of the new #ClearFake variant that relies on compromised websites injected with the malicious JavaScript framework, the #EtherHiding technique, and the #ClickFix social engineering tactic.

https://blog.sekoia.io/clearfakes-new-widespread-variant-increased-web3-exploitation-for-malware-delivery/

#etherhiding (hiding malicious code in blockchain based smart contracts) is not only by #ClearFake related actors – but now also for #Magecart 👇

Вредоносный код навсегда сохранили в блокчейне

Один из старых хакерских трюков — распространять вредоносное ПО под видом обновления браузера . На взломанном сайте размещается плашка с утверждением, что для просмотра нужно обновить браузер. И кнопка для скачивания обновления, как на скриншоте с прошлогодней атаки ClearFake . Таким образом, жертва самостоятельно устанавливает вредоносное ПО на свой компьютер. В прошлом году злоумышленники разработали умный способ защитить вредоносный софт от уничтожения. Они разместили его в децентрализованном анонимном блокчейне . То есть интегрировали код в смарт-контракт, который навечно сохранился в открытом доступе.

https://habr.com/ru/companies/globalsign/articles/878822/

#блокчейн #обновление_браузера #BSC #Binance_Smart_Chain #Binance #BNB #WordPress #ClearFake #BscScan #EtherHiding

Cybersecurity Experts Warn of Rising Malware Threats from Sophisticated Social Engineering Tactics https://thecyberexpress.com/ta571-and-clearfake-campaigns/ #TheCyberExpressNews #CybersecurityNews #ClearFakecampaign #PowerShellscripts #TheCyberExpress #FirewallDaily #EtherHiding #ClearFake #TA571

@rmceoin #etherhiding is the new blockchain-powered version of #clearfake
https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16

EtherHiding: Why hackers may prefer Binance’s BNB Smart Chain - According to cybersecurity analysts at 0xScope and CertiK, threat... - https://cointelegraph.com/news/ether-hiding-why-hackers-prefer-binance-bnb-smart-chain #smartcontracts #etherhiding #wordpress #bnbchain #malware #hackers #scams #bsc