Botnet Trojan delivered through ClickFix and EtherHiding
Pulse ID: 69a757a872a0ab148da31e83
Pulse Link: https://otx.alienvault.com/pulse/69a757a872a0ab148da31e83
Pulse Author: Tr1sa111
Created: 2026-03-03 21:50:32
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #EtherHiding #InfoSec #OTX #OpenThreatExchange #Trojan #bot #botnet #Tr1sa111
Des cybercriminels au service de la Corée du Nord ont développé une technique sophistiquée pour dissimuler leurs programmes malveillants : ils exploitent désormais la blockchain Ethereum comme refuge numérique. Cette méthode inédite, baptisée « EtherHiding », transforme l'infrastructure décentralisée des cryptomonnaies en arsenal offensif. Les chercheurs en cybersécurité tirent la sonnette d'alarme face à cette escalade technologique.
Une méthode inédite, baptisée « #EtherHiding », transforme la #blockchain de #cryptomonnaies #Ethereum en arsenal offensif. Les #chercheurs en #cybersécurité de #Google tirent la sonnette d' #alarme face à cette escalade #technologique
Des cybercriminels au service de la Corée du Nord ont développé une technique sophistiquée pour dissimuler leurs programmes malveillants : ils exploitent désormais la blockchain Ethereum comme refuge numérique. Cette méthode inédite, baptisée « EtherHiding », transforme l'infrastructure décentralisée des cryptomonnaies en arsenal offensif. Les chercheurs en cybersécurité tirent la sonnette d'alarme face à cette escalade technologique.
Botnet Trojan delivered through ClickFix and EtherHiding
A sophisticated phishing campaign impersonating Tesseract OCR was discovered, utilizing typosquatting and ClickFix techniques. The attack chain, named OCRFix, employed multi-stage malware deployments with heavy obfuscation and defense evasion techniques, including EtherHiding. The campaign used BNB Smart Chain TestNet to hide C2 domains through smart contracts. The malware delivery process involved three stages: a loader, a secondary loader for persistence, and a bot listener. The final payload connected to a bot control panel, allowing attackers to manage infected hosts and deploy additional malware. The campaign demonstrated a combination of simple initial access methods with complex delivery chains, highlighting the ongoing effectiveness of techniques like ClickFix and the importance of robust phishing defenses.
Pulse ID: 69a163c992e9afc70efc55d7
Pulse Link: https://otx.alienvault.com/pulse/69a163c992e9afc70efc55d7
Pulse Author: AlienVault
Created: 2026-02-27 09:28:41
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #EtherHiding #InfoSec #Malware #OTX #OpenThreatExchange #Phishing #RAT #Trojan #TypoSquatting #bot #botnet #AlienVault
Source et contexte: Expel (blog, Marcus Hutchins, 20 janv. 2026) publie une analyse technique de la campagne malware ClearFake/ClickFix, active sur des centaines de sites compromis et axée sur l’évasion défensive. • Ce que fait ClearFake: framework JavaScript malveillant injecté sur des sites piratés, affichant un faux CAPTCHA “ClickFix” qui incite l’utilisateur à faire Win+R puis à coller/valider une commande, déclenchant l’infection. La chaîne JS est obfusquée et prépare des charges ultérieures.
EtherHiding emerges as a malware delivery mechanism!
Google threat intelligence is reporting North Korean nation-state actor "UNC5342" is leveraging transactions on public blockchains to store and retrieve malicious payloads.
EtherHiding executes a social engineering campaign (fake job interviews, crypto games) as the initial compromise to lure developers — often those working in the cryptocurrency or tech industries — into downloading malware disguised as job-related files or coding challenges.
Once a target opens the file, a malicious script connects to a public blockchain like BNB Smart Chain or Ethereum, to retrieve encrypted code from a smart contract. That code installs a JadeSnow loader, which in turn delivers a more persistent backdoor known as InvisibleFerret that has been used in multiple cryptocurrency thefts.
https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding #Security #CyberSecurity #Hackers #CyberAttack #UNC5342 #Google #Malware #SmartContracts #Crypto #CryptoCurrency #EtherHiding #SocialEngineering #BlockChain
Google reports DPRK group UNC5342 uses EtherHiding to deliver backdoors and steal crypto, marking the first nation-state use of a tactic designed for resistant attacks.
North Korean hackers are taking stealth to a new level: embedding malware into blockchain smart contracts and tricking devs with fake job interviews. Are we ready for a world where your next code review could be a trap?
#etherhiding
#northkoreanhackers
#blockchainsecurity
#malwaredistribution
#smartcontracts
#cyberthreats
#socialengineering
#infosec
OTX Bot
Rod2ik 🇪🇺 🇨🇵 🇪🇸 🇺🇦 🇨🇦 🇩🇰 🇬🇱 ☮🕊️
Rod2ik 🇪🇺 🇨🇵 🇪🇸 🇺🇦 🇨🇦 🇩🇰 🇬🇱☮🕊️
CyberVeille.ch
goneo
BGDon 🇨🇦 🇺🇸 👨💻
Ivan
eicker.news ᳇ tech news
The DefendOps Diaries