A North Korea-linked malware campaign has found a way to keep infected computers connected to its operators. Instead of storing malware on Ethereum, the attackers hide the location of a control server inside cryptocurrency transfers.
The campaign reaches developers through fake job offers, tainted code repositories and malicious software packages. Running the code can install a remote access tool and a credential stealer across Windows, macOS and Linux.
Researchers from Ransom-ISAC identified the new Ethereum component in September 2026 samples of XCTDH.
Ransom-ISAC said in a report shared with Cyber Security News (CSN) that the technique gives the malware another way to find its operator if other routes are disrupted.
The operation was first documented in October 2025, but the researchers found its Ethereum signals began in June 2026. They counted 2,655 transactions over 90 days. The report does not establish how many computers were infected or how much data was stolen.
Hackers Turned Ethereum Into a Secret Messaging System
The method, called HashHiding by Ransom-ISAC, turns the recipient address of an Ethereum transfer into a tiny message. Its first four bytes represent the server’s internet address, and the next two represent its port.
The remaining bytes contain a second endpoint and padding. That is different from placing full malware payloads in blockchain transaction data.
These transfers carry no smart contract call or hidden script. Most move no cryptocurrency, while a few transfer a tiny amount to an address whose private key nobody is expected to control.
The malware watches transactions sent from the operator’s signaling wallet. It scans recent Ethereum blocks through public access points, finds a matching transfer, decodes its recipient address and contacts the server it reveals.
The server then supplies code that can rebuild the infection. Earlier reporting on malware servers hidden inside Ethereum transfers described a related method called NullReceiver.
.webp)
Ransom-ISAC credits that earlier public description, while tracing this separate campaign through its own on-chain collection. The distinction matters because a blockchain address here acts as a signpost, not a storage site for malware.
The operator changed the encoded destination four separate times during the observed period. The first two signals pointed to the same internet address on different ports; later signals moved to another address range. One subsequent change altered only the final number of the server address, a shift that could escape blocklists.
Multiple Paths Keep Malware Connected
Ethereum is only one part of this operation. The initial loader checks transactions on TRON, with Aptos as a backup, to locate encrypted JavaScript stored in BNB Smart Chain transactions. That older route delivers code, while the Ethereum route supplies a fresh server location.
The attack begins when a developer follows a fake recruitment prompt and runs a poisoned project or package. As JavaScript loaders hidden in repositories have shown, a project can carry code that contacts blockchain services after execution.
Here, the hidden loader brings in later stages without an obvious malicious download link. The updated remote access tool can run commands, record keystrokes and watch the clipboard.
A separate one-time stealer seeks browser information, password manager data, cloud storage credentials and cryptocurrency wallet material. Researchers counted 153 wallet targets and said stolen data leaves through a messaging bot interface.
The Ethereum scanner starts alongside the remote access tool, not only after a connection fails. A hardcoded server location and the older cross-chain path also remain active. This parallel design means blocking one server or one blockchain access point may leave another route open.
The broader risk resembles developer attacks using blockchain payloads, where a trusted-looking development task becomes the first step of compromise.
Ransom-ISAC recommends watching for unexpected Ethereum block queries followed by unusual server connections and monitoring the signaling wallet for new destination changes.
Teams investigating a suspected infection should also examine Node.js processes running evaluated code and review developer environments.
Removing a known server alone is not enough if the malware can read a newer server address from public blockchain records and start the chain again.
Indicators of compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response:Integrate TI Lookup in your SOC
Share
Published by
Tags:cyber securitycyber security news
51 seconds ago
Recent Posts
- Cyber Security News
SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers
Fake software download pages are drawing Windows users into a Silver Fox-linked malware campaign. The…
- Cyber Security
OpenAI Scrapped the New GPT-6.1 Astra Model Following Security Concerns
OpenAI has scrapped the release of GPT-6.1 Astra after internal safety testing exposed troubling failures…
- Cyber Security News
GPT-6 Astra AI Agent Tried to Deceive Developers and Hack Software Supply Chains
The UK AI Security Institute (AISI) recently disclosed that during cybersecurity evaluations, the GPT-6 Astra…
- Cyber Security News
GitHub AI Security Agent Finds 24 Android Vulnerabilities Including Account Takeover Flaws
GitHub Security Lab has disclosed that its open-
- Cyber Security News
Hackers Weaponizing ChatGPT’s Custom GPT Feature to Trick Victims into Installing Malware
Hackers are abusing ChatGPT’s Custom GPT feature to impersonate AI products and trick users into…
- Cyber Security News
AgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems
A newly tracked Windows remote access trojan called AgtaBackup RAT is using fake Microsoft Store…
