ClickFix Campaign Uses EtherHiding to Hide Malware and Exposes DPRK Wallet Trail

ClickFix-style fake macOS updates are now being weaponized with EtherHiding-backed command‑and‑control and a DPRK-linked crypto laundering network, turning a routine search click into a full-stack theft operation spanning browser, endpoint, blockchain, and exchange infrastructure.

Instead of traditional web C2, the implant resolves its live command‑and‑control endpoints from Ethereum smart contracts, a takedown‑resistant pattern known as EtherHiding and previously tied to DPRK cluster UNC5342 and the “Contagious Interview” campaign.

The initial lure is a full‑screen, browser-rendered fake macOS “Installing System Update / reboot” sequence that locks out normal interaction and makes the host appear frozen or as if it is restarting.

Before the victim sees any instructions, the page silently copies a base64‑encoded attack command into the clipboard, then tells the user to open Terminal and paste classic ClickFix.

The activation appears single‑use on the compromised page, shifting the only real danger point to Terminal: closing the tab leaves the system clean, but pasting and executing the clipboard payload hands the attacker full remote code execution.

Once executed, the dropper installs Node.js if necessary and launches an obfuscated ~38 KB RAT (internally v1.0.3) that treats the blockchain as its configuration layer.

Using eth_call across ~20 public RPC endpoints, the implant XOR‑decodes a base64 blob into {url, key} values that define its C2, then beacons every ~5 minutes, running attacker‑supplied JavaScript via eval() and returning output over the same encrypted channel.

AllSecure researchers uncovered a macOS malvertising chain that starts with an ordinary search for electrophoresis machines and ends with a Node.js backdoor, a 157‑wallet infostealer, and a malicious Chrome extension planted via ClickFix social engineering.

Over that channel it is tasked a fixed sequence: first an infostealer module that targets 157 desktop and extension wallets, browser secrets, SSH keys and cloud tokens; second a sideloaded MV3 Chrome extension masquerading as “Google Drive Offline,” patched into Chrome’s Secure Preferences to drain wallets and maintain long‑term browser visibility.

Two embedded Ethereum addresses contracts resolving rg-telemetry.sbs/api and th-updates.sbs/analytics turned out to be EtherHiding configuration contracts with byte‑identical code and zero balances, forcing investigators to pivot to the wallets that deployed and funded them.

ClickFix Campaign Uses EtherHiding

Each contract was created by a disposable wallet following an industrialized four‑step script: receive ~0.0126 ETH, deploy the contract, write config, forward ~0.006 ETH to a manager wallet, then abandon.

On the backdoor side, funding traces to KuCoin’s “17” hot wallet, which pushed 464.80 ETH (about 890,000 dollars) across 281 transfers between 28 May and 30 July 2026.

An attacker treasury that moved roughly 1.96 million dollars in nine weeks before being drained, while the extension side is seeded from Binance USDT withdrawals into a laundering network whose sinks are tagged Fake_Phishing2114928 and saturated with address‑poisoning spam.

The tradecraft aligns with DPRK UNC5342 and the Contagious Interview campaign macOS ClickFix lures, EtherHiding smart‑contract C2, eval‑based RCE, crypto and credential theft, and exchange‑funded disposable wallet fleets marking a maturation of earlier “malicious contracts” research presented at HITB 2021 into live nation‑state tooling.

Defenders should treat any host that may have executed the Terminal command as compromised: remove malicious LaunchAgents and cache payloads, rotate all credentials and move crypto from a clean device.

Hunt for clipboard‑driven shell one‑liners, Node.js launched from unusual cache paths, Chrome Secure Preferences tampering, high‑privilege extensions, and unexpected eth_call traffic to public RPC endpoints.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide