North Korean EtherHiding Targets Crypto Wallets and Developer Credentials

Key Takeaways

• A North Korean-linked campaign, dubbed “EtherHiding,” is actively targeting macOS users.
• The attack leverages fake macOS update screens and social engineering to trick victims into installing malware.
• Threat actors aim to steal cryptocurrency wallets, browser data, and developer credentials.
• The campaign utilizes Ethereum smart contracts for resilient command-and-control (C2) infrastructure, making it harder to disrupt.
• Over $890,000 in Ethereum has been traced to attacker treasuries since late May, though operator attribution is not confirmed for all chains.

A sophisticated cyber campaign, suspected to originate from North Korea, is employing deceptive macOS update screens to compromise victims’ systems. This operation, termed “EtherHiding,” is designed to pilfer cryptocurrency wallets, sensitive browser information, and crucial developer credentials, transforming routine web browsing into a potential conduit for severe security breaches.

The attack begins with a “ClickFix”-style deception, where a web page simulates a frozen or rebooting Mac. Victims are then prompted to open their Terminal application and paste a command that the malicious page has already placed into their clipboard. This seemingly innocuous action initiates the entire infection sequence, as detailed in a comprehensive report.

Security analysts at AllSecure uncovered this activity while investigating a malvertising incident that arose during an ordinary online research session. The researchers identified distinct overlaps between the campaign’s tactics and those previously attributed to North Korean groups UNC5342 and “Contagious Interview.” Notably, this campaign expands beyond the typical fake job offers and developer recruitment lures, utilizing a broader delivery mechanism.

The EtherHiding campaign represents a significant threat due to its multi-faceted approach, integrating social engineering, remote access malware, cryptocurrency wallet theft, browser extension hijacking, and a robust blockchain-based command-and-control infrastructure.

AllSecure said in a report that the operation’s primary goal is to compromise macOS users and steal their cryptocurrency and developer credentials.

North Korean EtherHiding Campaign Targets Crypto Wallets

Once the victim executes the malicious command, a dropper initiates the installation of Node.js, subsequently deploying an obfuscated remote access trojan (RAT). This RAT distinguishes itself by not relying on conventional, fixed servers for its instructions. Instead, it dynamically retrieves live command-and-control (C2) details by querying Ethereum smart contracts.

This innovative method, known as EtherHiding, significantly complicates efforts to disrupt the malware. The smart contract serves as a highly resilient configuration layer, enabling the attackers to update their backend infrastructure without needing to modify the malware already present on compromised Macs. This blockchain-resolver pattern has also been observed in other recent EtherHiding malware activities.

The backdoor communicates with its C2 infrastructure approximately every five minutes and is capable of executing JavaScript code provided by the attackers. To ensure persistent access, the malware establishes persistence through various mechanisms, including creating LaunchAgent entries, modifying shell profiles, and embedding hidden files within cache directories. These actions ensure the malware remains active even after system restarts.

Researchers identified two distinct Ethereum configuration contracts embedded within the malware. These contracts, while holding no cryptocurrency themselves, function as pointers, directing infected devices to separate infrastructures for the backdoor and the malicious browser extension. This separation enhances the resilience and agility of the attack infrastructure.

Wallet Theft and Remediation

Upon gaining initial access, the malware deploys an infostealer module designed to target data from a staggering 157 different cryptocurrency wallets. Beyond digital currency, the infostealer also exfiltrates saved browser passwords, cookies, browsing history, bookmarks, SSH keys, cloud service credentials, npm configuration files, and Foundry keystores, all of which could expose critical development environments.

Following data exfiltration, the campaign covertly installs a malicious Chrome extension, cleverly disguised as “Google Drive Offline.” This extension demands extensive permissions, including browser debugging capabilities, access to all cookies, native messaging, and unrestricted access to all URLs. This broad access grants the attackers persistent monitoring and control over the victim’s browser activities.

The targeting of developers carries implications far beyond the immediate loss of cryptocurrency. Stolen cloud keys, source-control credentials, and active browser sessions can provide attackers with a direct pathway into corporate networks. This tactic echoes previous North Korean npm package attacks that specifically targeted developers and sensitive project data.

The financial impact of this operation is substantial. AllSecure has tracked approximately 464.80 ETH, valued at roughly $890,000, flowing into the attacker’s treasury associated with the backdoor component. This sum was accumulated through 281 transfers between late May and July 2026, though researchers noted they could not definitively confirm a single operator for both deployment chains.

What You Should Do

• Immediately Isolate Compromised Devices: If a user has pasted and executed the malicious command, the device should be disconnected from all networks without delay.
• Conduct Thorough Forensics: Examine the compromised device for malicious LaunchAgents (~/Library/LaunchAgents/com.<random>.plist), altered .zshrc entries, suspicious Node.js processes running from cache directories (~/Library/Caches/<random>), and unexpected Chrome extensions, particularly one named “Google Drive Offline.”
• Reset All Credentials: From a clean, uncompromised device, reset all passwords and credentials that may have been stored on the affected system, including browser-saved passwords, SSH keys, cloud credentials, and npm configuration files.
• Secure Cryptocurrency Assets: Transfer any cryptocurrency assets to a new, secure wallet from a clean device.
• Educate Users: Reinforce the critical security principle that legitimate macOS updates will never require users to manually paste commands into the Terminal.
• Implement Behavioral Detections: Monitor for host indicators such as NODE_TLS_REJECT_UNAUTHORIZED=0, stopped NotificationCenter processes, Node.js running from non-standard locations like Library/Caches, and developer endpoints issuing eth_call.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.