A malware campaign linked to North Korean threat actors is combining an old social-engineering trick with a genuinely novel piece of infrastructure: hiding its command-and-control instructions inside Ethereum smart contracts. The technique, known as EtherHiding, makes the operation harder to disrupt and has already been tied to close to $890,000 in cryptocurrency moving through attacker-controlled wallets.

A Fake Update Screen Starts the Chain

The attack begins with a ClickFix-style lure: a malicious web page renders what looks like a frozen or rebooting Mac, complete with a “Critical Security Update Required” overlay and a “Copy Verification Code” button. Victims are instructed to open Terminal and paste a command that the page has already copied to their clipboard — a technique that relies on the victim’s own action to kick off the infection rather than a traditional exploit.

Researchers at AllSecure identified the activity while investigating a malvertising incident that began with an ordinary web search, and shared their findings with Cyber Security News. They linked the campaign’s tradecraft to the North Korean-associated group UNC5342 and the broader Contagious Interview activity cluster, noting that this malvertising delivery method extends beyond the group’s more familiar fake job-interview and recruitment lures.

How EtherHiding Works

Once a victim runs the pasted command, a dropper installs Node.js and launches an obfuscated remote access trojan. Rather than reaching out to a fixed, traditional command-and-control server, the malware queries Ethereum smart contracts to retrieve live instructions — the defining feature of the EtherHiding technique.

This approach gives attackers a resilient configuration layer that is difficult for defenders to take down: because the smart contract itself just stores configuration data, attackers can update their infrastructure destinations without ever modifying the malware already installed on a victim’s machine. Researchers identified two such configuration contracts embedded in the malware, though the contracts themselves held no funds — their role was purely to point infected devices toward separate, attacker-controlled infrastructure.

Once active, the backdoor checks in with its contract-based configuration roughly every five minutes and can execute attacker-supplied JavaScript. It establishes persistence through several mechanisms, including LaunchAgent entries, modified shell profiles, and hidden files stored in cache directories — ensuring the malware survives a system restart.

What the Malware Steals

After gaining a foothold, the malware deploys an infostealer built to search for data from 157 different cryptocurrency wallets. Its collection extends well beyond wallet data, reportedly pulling in:

• Saved browser passwords, cookies, history, and bookmarks
• SSH keys and cloud service credentials
• npm configuration files and Foundry keystores tied to development environments

The campaign also silently installs a malicious Chrome extension disguised as “Google Drive Offline.” That extension requests broad permissions — including browser debugging, cookie access, native messaging, and access to all URLs — giving attackers a persistent way to monitor or manipulate browser activity even after the initial infection is cleaned up.

The focus on developer credentials and cloud keys is a notable escalation: stolen source-control access and cloud credentials can give attackers a route into corporate infrastructure well beyond an individual victim’s personal wallet, echoing the pattern seen in past North Korean campaigns that targeted developers through malicious npm packages.

Following the Money

AllSecure’s financial analysis tracked roughly 464.8 ETH — worth approximately $890,000 — moving into the backdoor’s attacker-controlled treasury across 281 separate transfers between late May and July 2026. The researchers stopped short of confirming that a single operator controlled both the backdoor and browser-extension components of the campaign, but the shared infrastructure and technique suggest close coordination.

What to Do if You Suspect an Infection

Organizations should treat any device where a user pasted and executed the Terminal command as compromised. Recommended response steps include:

• Isolating the device immediately from the network
• Checking for malicious LaunchAgent entries and unexpected modifications to .zshrc or other shell profiles
• Looking for suspicious, cache-resident Node.js processes
• Removing any unexpected Chrome extensions, particularly ones mimicking legitimate Google tools
• Resetting credentials from a known-clean device and moving cryptocurrency assets to a new wallet

The underlying lesson for users is a simple one, but worth repeating: legitimate macOS software updates never require pasting a command into Terminal. Any page asking for that is, by definition, not a real system update.