DPRK Hackers Use Ethereum Smart Contracts to Hide macOS Malware C2 Infrastructure

North Korean state-sponsored threat actors have unveiled a sophisticated cyber campaign that leverages Ethereum smart contracts as resilient command-and-control (C2) infrastructure, marking a significant evolution in nation-state malware operations.

Security researchers have linked the activity to the DPRK-associated UNC5342 threat cluster, known for its “Contagious Interview” campaigns targeting software developers and cryptocurrency professionals.

By adopting the EtherHiding technique, the attackers eliminate reliance on traditional command-and-control servers, making their infrastructure far more resistant to disruption while expanding their ability to steal cryptocurrency assets, browser data, and developer credentials from macOS systems.

DPRK Hackers Use Ethereum Smart Contracts

According to threat intelligence researchers, the attack begins with a convincing ClickFix-style social engineering lure delivered through malicious online advertisements.

Victims are presented with a full-screen fake macOS crash or security update page claiming that an urgent reboot or system verification is required.

A prominent “Copy Verification Code” button silently copies a malicious shell command to the user’s clipboard while instructing them to open Terminal and paste the command into the zsh shell.

No compromise occurs automatically, the infection depends entirely on the victim manually executing the copied command, demonstrating how attackers continue to exploit user trust rather than software vulnerabilities.

Once executed, the malicious one-line command downloads a Base64-encoded payload using curl, installs Node.js if it is not already available, and launches an obfuscated Node.js-based remote access trojan identified internally as RAT v1.0.3.

The malware establishes persistence using multiple techniques, including LaunchAgents, modifications to the user’s shell profile, and hidden files stored within cache and temporary directories.

It then silently contacts its command-and-control infrastructure approximately every five minutes, retrieving attacker-supplied JavaScript code that is executed using the dangerous eval() function before securely transmitting the results back through encrypted communication channels.

The most innovative aspect of the campaign is its use of EtherHiding, a technique that stores live configuration data directly within Ethereum smart contracts rather than on conventional servers or domains.

Instead of contacting hardcoded infrastructure, the malware performs eth_call requests through publicly accessible Ethereum Remote Procedure Call (RPC) endpoints to attacker-controlled smart contracts.

These contracts contain the current C2 server address and encryption keys required for communication. Because the configuration exists permanently on the blockchain, operators can simply update the smart contract whenever infrastructure changes, allowing infected systems to automatically retrieve new C2 information.

This decentralized approach significantly complicates incident response efforts, as security defenders cannot easily disable the malware by seizing domains or shutting down hosting providers.

Following successful deployment, the backdoor downloads two additional malicious components designed to maximize intelligence collection and financial theft. The first is a powerful infostealer capable of targeting data from 157 cryptocurrency wallets, including both browser-based and desktop wallet applications.

It also extracts saved passwords, browser cookies, browsing history, autofill data, SSH private keys, GPG keys, cloud provider credentials, and other sensitive developer artifacts.

This information enables attackers not only to steal cryptocurrency but also to compromise software repositories, cloud infrastructure, and enterprise environments using legitimate authentication credentials.

The second payload is a malicious Google Chrome extension disguised as Google Drive Offline. Built using the Manifest V3 (MV3) framework, the extension requests extensive permissions, including access to browser cookies, debugging capabilities, native messaging, and all visited URLs.

By modifying Chrome’s Secure Preferences file, the malware sideloads the extension so it appears to be a trusted installation.

Once active, it provides attackers with persistent browser-level surveillance, enabling credential theft, session hijacking, web manipulation, and long-term monitoring of user activity.

Researchers also traced the blockchain infrastructure supporting the campaign, revealing an organized operational workflow.

The Ethereum smart contracts were deployed using disposable wallets funded through withdrawals originating from major cryptocurrency exchanges, including KuCoin and Binance.

Each wallet received a small amount of Ether, deployed a contract, stored updated C2 configuration values, transferred any remaining funds to centralized treasury wallets, and was subsequently abandoned. This industrialized deployment process demonstrates the maturity and operational discipline behind the campaign.

The discovery highlights a growing trend in which advanced threat groups increasingly leverage decentralized technologies to strengthen malware infrastructure against traditional takedown efforts.

Organizations should educate users about ClickFix-style social engineering attacks, restrict unnecessary Terminal usage, monitor Node.js execution on managed endpoints, deploy advanced endpoint detection solutions, and continuously monitor browser extensions and blockchain-related network activity.

As nation-state actors continue integrating blockchain technology into their offensive operations, defenders must adapt their detection strategies to identify malicious behavior that extends far beyond conventional command-and-control infrastructure.