Netcrook
#EtherHiding
When a Blockchain Becomes the Back Office for Malware
A ClickFix-linked campaign shows how attackers can pair user trickery with on-chain infrastructure to rotate command links without relying on a single vulnerable server.
When Checkout Theft Hides in the Chain: The New Shape of Magecart Abuse
A reported HexMage campaign used Ethereum smart contracts and Sepolia-linked infrastructure in a way that may make payment skimmers more resilient and harder to disrupt.
Ethereum as a Hiding Place: Why Card Skimmers Are Getting Harder to Evict
A campaign tracked as HexMage shows how attackers can use Ethereum smart contracts through EtherHiding to keep checkout skimming instructions out of reach of ordinary hosting defenses.
When a WordPress Plugin Starts Talking to the Browser
A reported campaign links auto-loading WordPress code, a malicious Service Worker, and layered delivery tricks into a web attack path built for stealth and resilience.
When Malware Stops Renting Servers and Starts Hiding in Code on the Chain
A reported MaaS campaign ties browser lures, user-driven execution, and Polygon smart contracts into a harder-to-trace delivery path.
Paste Once, Pay Later: How Blockchain Staging Is Reviving Old Malware Tricks
A recent ACN CSIRT Italia advisory points to a campaign that mixes ClickFix-style social engineering with EtherHiding on BNB Smart Chain, turning a simple copy-paste prompt into a delivery path for malicious code.
When a Fake Mac Update Meets Blockchain Hiding, the Malware Trail Gets Harder to Kill
A ClickFix-style lure, EtherHiding infrastructure, and a reported DPRK-linked wallet trail show how one operation can blend social engineering, resilient delivery, and on-chain tracing.
On-Chain Dead Drops: How a Blockchain Channel Turned macOS Malware Harder to Unravel
A DPRK-linked cluster is reported to be using Ethereum smart contracts as a resilient command path, showing how public blockchain data can be repurposed into malware infrastructure.
When a Game Mod Becomes the First Stage of a Stealer Chain
A reported Minecraft Fabric mod campaign shows how trusted game add-ons can be used as an entry point for session-data theft and blockchain-resident command retrieval.
From Hidden WordPress Code to a Blocked Windows Loader: How a Web Compromise Tried to Cross the Line
A chain linking compromised WordPress sites, blockchain-hosted payload delivery, and a user-driven Windows execution attempt ended with rundll32.exe being stopped before GULoader could initialize.
When Malware Starts Renting Space on a Blockchain
ClearFake’s use of EtherHiding on BNB Smart Chain testnet smart contracts shows how on-chain storage can complicate the hunt for command-and-control infrastructure.
Blockchain Shadows: How the OCRFix Botnet Blends Phishing, ClickFix, and EtherHiding to Dodge Detection
A new multi-stage malware campaign leverages blockchain, social engineering, and clever evasion tactics to create a resilient criminal infrastructure.