What is EtherHiding and why is it used

EtherHiding — a technique where attackers hide malicious code (for example, JavaScript or loaders) inside smart contracts on public blockchains (Ethereum, BNB Smart Chain, etc.).

How it works:

• Smart contracts on blockchains are decentralized and immutable. You cannot simply “shut down a server” as in a traditional attack.
• Code stored on the blockchain can be invoked via read-calls (data reads) that do not create a transaction, do not leave an obvious trace, and do not require gas payment.
• An attacker who controls a contract can change its contents and thus change which malicious code will be delivered to a victim.

Thus, EtherHiding becomes a new way to “host” malware that is resistant to standard methods of blocking domains or servers.

How DPRK is using this

Researchers found that a North Korean hacking group known as UNC5342 is using EtherHiding in its operations.

How it works in practice:

1. Social engineering and phishing

   Attackers create fake job offers or conduct “interviews” to attract specialists — often from the crypto and tech sectors.

   They ask targets to do a “test task” or download something supposedly needed for the interview; in reality it’s malicious code.

2. Deploying a loader script

   A small JavaScript loader is placed on a (fake or compromised) website. When the user visits, this script runs in the victim’s browser.

3. Reading malicious code from the blockchain

   The loader queries a smart contract on the blockchain and reads an encoded malicious payload. Because this uses a read-call (no transaction), it’s nearly invisible on-chain.

4. Executing the malicious code on the victim’s machine

   The code runs on the victim’s computer and can install backdoors, steal data, cryptocurrency, etc.

Notably, attackers can switch between different blockchains (for example, from Ethereum to BNB Smart Chain) to complicate analysis and avoid blocking.

One of the tools observed is JADESNOW — a JavaScript loader that, via EtherHiding, retrieves a more serious backdoor (for example, INVISIBLEFERRET).

Advantages of this approach for attackers