NATION-STATE MALWARE HIDING ON BLOCKCHAINS

Summary from the TLDR Crypto newsletter

Google Threat Intelligence Group has observed a North Korean threat actor using EtherHiding to deliver malware and backdoors for cryptocurrency theft, marking the first nation-state adoption of this technique that stores malicious JavaScript payloads in blockchain smart contracts to create a decentralized, resilient command-and-control infrastructure. EtherHiding leverages blockchain immutability and read-only functions to fetch payloads without creating traceable transactions or paying gas fees, making conventional takedowns impossible while allowing attackers to update malware by simply modifying smart contracts. The attack chain targets developers through fake job interviews where victims download malicious npm packages containing downloaders that query blockchain smart contracts for second-stage payloads, ultimately deploying backdoors for remote system control and credential stealers targeting cryptocurrency wallets, like MetaMask and Phantom, along with browser passwords and password managers.