DPRK Hackers Use EtherHiding to Hide macOS Malware C2 in Ethereum Smart Contracts

A fake macOS update screen, a single pasted command, and a trail of stolen cryptocurrency have exposed one of the most technically inventive nation-state campaigns of 2026.

Researchers at AllSecure say they’ve confirmed a North Korean-linked operation that uses Ethereum smart contracts as unkillable command-and-control infrastructure, a technique called EtherHiding, to run a credential-and-crypto-theft campaign against everyday Mac users.

The investigation began when a researcher clicked an ordinary search result while researching lab equipment and was hit with a full-screen fake “macOS update” overlay.

DPRK Hackers Use EtherHiding

The page silently copied a malicious command to the clipboard and instructed the “frozen” user to paste it into Terminal. That single action triggered a chain reaction: a Node.js backdoor, an infostealer targeting 157 crypto wallets, and a malicious Chrome extension.

Unlike phishing emails or fake job offers commonly associated with DPRK’s “Contagious Interview” cluster, this lure relied purely on browser-based social engineering.

The fake reboot screen created urgency by mimicking a system crash, pushing victims to act before scrutinizing what they were doing. Closing the tab would have stopped the attack cold; pasting into Terminal did not.

Once executed, the dropper installed an obfuscated Node.js RAT that doesn’t call home to a traditional server. Instead, it queries an Ethereum smart contract via public RPC endpoints to fetch its live C2 address, XOR-decoded from on-chain data.

Because there’s no domain registrar or hosting provider to seize, operators can rotate infrastructure simply by writing new values to the blockchain. The implant then beacons every five minutes and executes attacker-supplied JavaScript via eval() giving the operators full remote code execution on infected machines.

Victims were tasked with two payloads in sequence: an infostealer that harvested data from 157 wallet types (Exodus, Ledger Live, Electrum, and more), browser-saved passwords, and developer credentials (SSH keys, AWS/Azure tokens); followed by a sideloaded Chrome extension disguised as “Google Drive Offline,” which patched Chrome’s integrity checks to gain persistent, broad access to browsing activity.

The two on-chain contract addresses embedded in the malware held no funds themselves; they were configuration layers, not wallets.

Tracing the wallets that deployed and funded those contracts led investigators to withdrawals from KuCoin and Binance, including 464.80 ETH (roughly $890,000) funneled through 281 transfers into an attacker treasury over nine weeks.

Notably, the two campaigns one funding the backdoor, one funding the extension appear to run on separate financial chains, with no shared counterparty found linking them to a single operator.

Security researcher Christian Papathanasiou, who first proposed blockchain-based C2 as a theoretical concept at Hack In The Box in 2021, called this campaign proof that “research concepts become nation-state tradecraft faster than defenders adapt.”

The case also signals a shift: DPRK-linked crypto theft is no longer confined to fake job interviews targeting developers it now hides inside ordinary web searches, widening the threat model for everyday users.

Defenders are urged to monitor eth_call traffic from non-browser processes, flag clipboard-driven Terminal execution, and treat the campaign’s contract addresses as durable indicators of compromise, even as domains rotate.