North Korean Hackers Exploit EtherHiding to Spread Malware and Steal Crypto Assets

According to Google Threat Intelligence Group (GTIG), North Korean threat actor UNC5342 is the first nation-state group observed using EtherHiding, a technique that embeds malware in smart contracts on public blockchains such as BNB Smart Chain and Ethereum to distribute payloads and conduct cryptocurrency theft. The method first appeared in September 2023 during the CLEARFAKE campaign attributed to UNC5142, which used deceptive overlays to trick victims into executing malicious code.

The attack chain begins with attackers compromising legitimate websites and injecting a small JavaScript loader that, once visitors are on the site, communicates with the blockchain to retrieve the main payload stored remotely via read-only calls that avoid gas fees.

Since February 2025, GTIG has tracked UNC5342 incorporating EtherHiding into an ongoing social-engineering operation dubbed Contagious Interview by Palo Alto Networks, targeting developers in the cryptocurrency and technology sectors through fake recruitment processes. JADESNOW and INVISIBLEFERRET are used in the infection chain, with JADESNOW acting as the initial downloader and INVISIBLEFERRET providing a backdoor for long-term espionage and data theft. The campaign also leverages multiple blockchains and centralized services to interact with the blockchain, complicating takedowns and attribution.