DPRK-linked threat actors are abusing Ethereum smart contracts as resilient command-and-control infrastructure in a highly sophisticated macOS malware operation, signalling a new phase in nation-state cybercrime focused on crypto theft and developer credential compromise.
Research by Christian Papathanasiou attributes this campaign to the DPRK-associated UNC5342 cluster, known for “Contagious Interview”-style activity, and confirms that the group has operationalised the EtherHiding technique to hide live C2 configuration data directly on the Ethereum blockchain.
The attack starts with a ClickFix-style browser lure: a full-screen fake macOS “update/reboot” page triggered via malvertising creates the illusion that the system has crashed, then instructs the user to open Terminal and paste a command that has already been silently copied to the clipboard.
Nothing is compromised until that command is executed, but once it is, a curl-and-pipe one-liner fetches a base64-encoded payload, installs Node.js if required, and launches an obfuscated Node.js remote access trojan internally labeled RAT v1.0.3.
This RAT establishes persistence using LaunchAgents, modifications to the user’s shell profile, and hidden files in cache and temporary directories, then beacons to its C2 roughly every five minutes, executing attacker-supplied JavaScript via eval() and returning output over an encrypted channel.
DPRK EtherHiding Malware Channel
Instead of reaching out to hard-coded servers for configuration, the malware uses EtherHiding, it issues eth_call requests through a pool of public Ethereum RPC endpoints to two attacker-controlled smart contracts that store the current C2 URL and encryption keys.
The contracts themselves hold no funds and serve purely as on-chain configuration beacons, allowing operators to rotate infrastructure by updating values on-chain while infected hosts simply pull the latest C2 data, a design that makes traditional domain or hosting takedowns ineffective.
Once the backdoor is active, it silently deploys two additional payloads, an infostealer module that targets 157 cryptocurrency wallets, browser secrets, and developer/cloud credentials, and a malicious Chrome extension masquerading as “Google Drive Offline” that is sideloaded by tampering with Chrome’s Secure Preferences so it appears trusted.
The infostealer harvests data from popular desktop and browser-based wallets, scrapes password databases, cookies, and histories from Chromium and Gecko-based browsers, and collects sensitive developer artefacts such as SSH keys, GPG material, and cloud provider credentials, turning a single macOS compromise into a pivot point into code repositories and infrastructure.
The Chrome extension, built as an MV3 plugin with broad permissions including debugger, nativeMessaging, cookies, and access to all URLs, gives the attackers long-term visibility and control inside the victim’s browser and can be driven from their own web properties via externally_connectable declarations, allsecure said.
On-chain tracing shows that the smart contracts used for EtherHiding were deployed and funded through industrialised wallet workflows seeded by major exchanges, with KuCoin and Binance withdrawals feeding disposable deployer wallets that receive a small amount of ETH, deploy a contract, write configuration, forward leftovers to treasury hubs, and are then abandoned.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
