Hackers Use Blockchain to Hide Malware in Plain Sight

At least two hacking groups are using public blockchains to conceal and control malware in ways that make their operations nearly impossible to dismantle, shows research from Google’s Threat Intelligence Group.

See Also: Top 10 Technical Predictions for 2025

Researchers uncovered two separate campaigns – one run by a North Korean state actor and another by a financially-driven cybercriminal group – exploiting public blockchains to hide their malware operations in plain sight.

The technique, known as EtherHiding, embeds malicious instructions in blockchain smart contracts rather than traditional servers. Since the blockchain is decentralized and immutable, attackers gain what the researchers call a “bulletproof” infrastructure.

The development signals an “escalation in the threat landscape,” said Robert Wallace, consulting leader at Mandiant, which is part of Google Cloud. Hackers have found a method “resistant to law enforcement takedowns” that and can be “easily modified for new campaigns.”

Researchers said hackers adapted EtherHiding to different ends. North Korea-linked UNC5342 uses it as part of a social engineering campaign to infiltrate developers and cryptocurrency firms, while UNC5142 employs it to spread infostealers through hacked WordPress sites.

EtherHiding first appeared in 2023 in a financially motivated campaign dubbed ClearFake, where attackers lured victims with fake browser update prompts. The concept is to store malicious code inside a blockchain transaction or smart contract and fetch it using read-only calls that leave almost no trace.

Since these calls don’t create visible transactions, defenders cannot rely on conventional indicators such as domains or IP addresses. For as long as the blockchain is operational, the “malicious code remains accessible,” the report said.

North Korean Group Targets Developers

North Korean threat group UNC5342 integrated EtherHiding into what Palo Alto Networks earlier called the Contagious Interview campaign. The operation impersonates recruiters on LinkedIn and job boards, approaching developers with offers from fake firms such as “BlockNovas LLC” and “Angeloper Agency.”

The threat actor drew the targets into staged interviews on messaging apps such as Telegram and Discord. During a supposed technical test, they asked the victims to download files from GitHub or npm repositories containing malware like JadeSnow and InvisibleFerret, which use EtherHiding to communicate with attacker-controlled smart contracts on the ethereum and BNB Smart Chain networks.

The researchers also traced how the infection chain unfolds: the JadesNow downloader queries blockchain contracts to fetch encrypted JavaScript payloads, which deliver the InvisibleFerret backdoor. Once installed, the malware can exfiltrate data, capture credentials and remotely control the system.

Researchers observed InvisibleFerret in some cases deploying an additional credential-stealing component designed to target web browsers and cryptocurrency wallets like MetaMask and Phantom. The stolen data is exfiltrated both to attacker servers and private Telegram channels.

The campaign generates cryptocurrency revenue for the North Korean regime and gathers intelligence from compromised developers.

Financially Driven UNC5142 Exploits WordPress

In a separate report, Google Mandiant profiled UNC5142, a financially motivated actor relying on EtherHiding to infect websites and distribute a range of information-stealing malware.

The actor compromises vulnerable WordPress sites, injecting JavaScript downloaders collectively dubbed ClearShort, which use smart contracts on the BNB Smart Chain as their control layer. The scripts fetch second-stage payloads or links to attacker-hosted landing pages.

UNC5142’s infrastructure stands out for its use of legitimate platforms to blend in. Malicious pages are hosted on Cloudflare’s pages.dev service, and command-and-control information is stored on the blockchain. The Google team found about 14,000 websites carrying traces of UNC5142’s injected scripts by mid-2025.

The group over time expanded its architecture from a single smart contract to a three-tier system mimicking a software “proxy pattern.” This allows rapid updates without touching the compromised sites. One contract acts as a router, another fingerprints the victim’s system and a third holds encrypted payload data and decryption keys. A single blockchain transaction, costing as little as a dollar in network fees, can change lure URLs or encryption keys across thousands of infected sites.

The researchers said the threat actor used social engineering tricks like fake Cloudflare verification or Chrome update prompts to persuade victims to run malicious commands. The lures deliver infostealers such as Vidar, Lummac.V2 and RadThief. The campaigns also show progression toward stronger encryption with AES-GCM and improved obfuscation.

In one example, the attacker’s JavaScript fetched encrypted HTML pages from Cloudflare, decrypted them client-side and prompted users to execute hidden PowerShell commands that downloaded final payloads disguised as media files.

The researchers’ analysis of blockchain transactions showed that UNC5142 maintained at least two parallel infrastructures, dubbed Main and Secondary, using identical smart contract code and funded by wallets linked through cryptocurrency exchange OKX. Updates to both occurred within minutes of each other, suggesting coordinated control by a single actor.

A Persistent Problem

Neither threat actor interacts directly with blockchain nodes, instead depending on centralized services like public RPC endpoints or API providers to fetch data. The dependency creates “points of observation and control” where defenders or service providers could potentially intervene, the researchers said.

In UNC5342’s case, the researchers contacted several API providers used in the campaign. Some acted quickly to block malicious activity, while others did not. The researchers said that inconsistent cooperation from intermediaries “increases the risk of this technique proliferating among threat actors.”

Smart contracts are public and immutable – meaning security teams cannot simply remove or block them. Even if tagged as malicious, the code will always be accessible.

Network-based filters built for traditional web traffic struggle with decentralized Web3 patterns. And the anonymity of wallet addresses and the low cost of blockchain transactions allow actors to iterate quickly and sustain campaigns indefinitely.

In UNC5142’s operations, the researchers estimated that updating an entire malware delivery chain costs between 25 cents and $1.50 per transaction. The efficiency, combined with the immutability of blockchain storage, gives attackers agility that surpasses conventional infrastructure.

The researchers also identified possible choke points. Since attackers often rely on third-party APIs or hosting platforms to interface with the blockchain, coordinated responses from providers can help disrupt access. Chrome Enterprise’s centralized management tools, for one, could enable administrators to block malicious downloads or enforce automatic browser updates, undermining the fake “out-of-date Chrome” prompts used in earlier campaigns.

The researchers said that the adoption of blockchain-based hosting “marks a new phase in malware resilience.” Defenders can still monitor centralized touchpoints, but the underlying infrastructure that is public, distributed and immutable offers attackers an advantage.