Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites

A financially motivated threat actor codenamed UNC5142 has been observed abusing blockchain smart contracts to distribute information stealers such as Atomic (AMOS), Lumma, Rhadamanthys (aka RADTHIEF), and Vidar, by compromising WordPress sites on Windows and macOS devices. According to Google Threat Intelligence Group (GTIG) in a report shared with The Hacker News, UNC5142 uses EtherHiding to obscure malicious code by placing it on a public blockchain such as the BNB Smart Chain.

As of June 2025, Google flagged about 14,000 web pages with injected JavaScript tied to UNC5142, though GTIG notes it has not spotted any UNC5142 activity since 23 July 2025, suggesting a pause or pivot. A multi-stage JavaScript downloader called CLEARSHORT delivers the malware via hacked sites, with the first stage retrieving a second stage by interacting with a malicious smart contract on the BNB Smart Chain.

The campaign relies on a two-tier smart contract infrastructure, with a Main infrastructure created on 24 November 2024 and a parallel Secondary infrastructure funded on 18 February 2025, enabling rapid updates to the infection chain while complicating takedown attempts.

On Windows, the chain drops an HTA file from a MediaFire URL to run a PowerShell script that fetches an encrypted payload, while macOS attackers used ClickFix decoys in February and April 2025 to prompt users to run a bash command and retrieve the Atomic Stealer payload.