Cybercriminals are taking malware delivery to a new level with EtherHiding, a technique that stores malicious payloads directly inside blockchain smart contracts. First observed by Censys researchers, this approach enables attackers to update and rotate malware without altering compromised websites, creating a durable, decentralized delivery network.
How EtherHiding Works
The attack begins with a JavaScript injection on a compromised website. Criminals embed a Base64-encoded script disguised as a fake CAPTCHA image, often using the familiar reCAPTCHA logo. When victims attempt to verify they are human:
- The injected script loads the Ethers.js library.
- It communicates with Binance Smart Chain smart contracts via
eth_callrequests. - Payloads are fetched dynamically based on the victim’s operating system (Windows or macOS).
This decentralized hosting model eliminates static URLs, making takedowns nearly impossible.
Smart Contract Logic and Social Engineering
- Contract Gate Mechanism: Accepts or denies victims based on identifiers stored in browser cookies.
- Dynamic Updates: Attackers modify payloads by changing blockchain data, not web servers.
- Click-Fix Technique: Victims are tricked into copying and running commands locally, bypassing antivirus defenses.
On Windows, the command triggers MSHTA for remote execution. On macOS, it uses curl to download scripts and establishes persistence via LaunchAgent files.
macOS-Specific Payload Behavior
The macOS variant goes beyond initial infection:
- Credential Theft: Extracts stored passwords using native tools.
- C2 Communication: Maintains contact with attacker servers for updates.
- Data Scraping: Collects Telegram and Steam profile data to locate new C2 addresses.
Why EtherHiding Is Dangerous
By leveraging blockchain infrastructure, attackers gain:
- Resilience: Decentralized storage makes payload removal nearly impossible.
- Stealth: No static URLs or centralized servers to block.
- Adaptability: Malware updates occur on-chain without touching compromised sites.
Detection and Defense
Security teams can detect EtherHiding by:
- Monitoring for Base64-encoded scripts and fake CAPTCHA assets.
- Flagging unexpected Ethers.js imports on websites.
- Blocking suspicious eth_call requests to blockchain nodes.
Key Takeaways
EtherHiding demonstrates how decentralized technology, originally designed for transparency and security, is now being weaponized for adaptive malware distribution. Organizations must adopt behavioral detection, script integrity checks, and blockchain traffic monitoring to counter this emerging threat.
