Threat reportMalwareTL-2026-1670
EtherHiding on macOS: Blockchain-Resolved C2 via Polygon Smart Contract
EtherHiding on macOS (TL-2026-1670), also tracked as EtherHiding macOS implant, is a high-severity malware campaign, first published 2026-07-24. It is linked to a North Korea-nexus actor with medium confidence, affects Apple macOS, maps to 21 MITRE ATT&CK techniques (T1008, T1027, T1036.005), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-1670
- Threat ID
- TL-2026-1670
- Also known as
- EtherHiding macOS implant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- technology, software-development, cryptocurrency, web3
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in EtherHiding on macOS
Malware and tooling: AWS Chime
How EtherHiding on macOS works
A persistent macOS Launch Agent implant, delivered via a fake technical-interview lure over AWS Chime, resolves its command-and-control domain by issuing read-only eth_call requests to a Polygon smart contract (the EtherHiding dead-drop-resolver technique) and decoding the returned hex value into a beacon domain that rotates roughly weekly.
In July 2026, Prophet Security's autonomous SOC platform reconstructed the complete attack chain of a macOS implant that uses the EtherHiding technique — a class of blockchain dead-drop resolvers first documented by Google Threat Intelligence Group (GTIG)/Mandiant against the financially motivated actor UNC5142, and popularized by DPRK-nexus operators against crypto and Web3 targets — to hide its command-and-control (C2) infrastructure inside a Polygon (Chain ID 137) smart contract at address 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0.
Initial access is assessed with moderate confidence as social engineering consistent with 'Contagious Interview' tradecraft: DPRK-nexus actors have run a sustained campaign since at least December 2022 in which operators pose as recruiters, stage multi-step fake technical interviews, and induce victims to execute attacker-supplied code during a live video call. In this incident, the victim joined an AWS Chime meeting posing as a technical interview and shortly afterward downloaded and executed a malicious shell script.
The shell script wrote a Launch Agent property list to ~/Library/LaunchAgents/com.<random-string>.plist with RunAtLoad and KeepAlive set to true and an hourly StartInterval, giving the implant persistence and re-execution without a dropped binary. Each trigger ran a one-line shell command — /bin/bash -c "echo '<base64>' | base64 -d | osascript" — that decoded a base64 blob into an obfuscated AppleScript payload (with character-code obfuscation to further conceal strings) and executed it via osascript. A daemon-privileged variant was also observed that executes at boot with elevated privileges.
At runtime, the AppleScript issued unauthenticated, read-only eth_call JSON-RPC requests (function selector 0x2686ecea, the getter) against multiple public Polygon RPC providers — polygon.drpc.org, polygon.publicnode.com, polygon-mainnet.gateway.tatum.io, and tenderly.rpc.polygon.community — to read the current C2 domain out of contract storage. Because eth_call reads require no wallet, no gas, and no authentication, and because thousands of independent Polygon full nodes serve the same immutable contract state, this dead-drop resolver is highly resistant to conventional domain/IP takedown: defenders can seize the resolved domain, but the operator simply calls the contract's setter (selector 0xd75d1ba6) to rotate to a fresh one. The hex return value was decoded to an ASCII domain string, fetched over HTTPS, and the response piped directly into osascript for second-stage execution — a fileless chain in which the malicious domain is never resident in any binary or plist on disk.
An operator wallet address (0x363aeaf1f67f1fb7abddc3f9806a301f1c64abe3) was observed writing to the contract; on-chain history shows the contract was deployed on 2026-05-01 with test/decoy values, followed by the first operational C2 domain from 2026-05-18 onward, with domains rotating roughly weekly (with recent acceleration) and the most recent operational domain observed 2026-07-09; a re-query on 2026-07-21 (post-analysis) surfaced an additional unseen domain. Funding-chain analysis traced the deploying/operator wallet through a distribution hub to a wallet carrying a public phishing label, and two operator-linked wallets were found to share a vanity address prefix, consistent with operator tooling reuse across campaigns. Beacon check-ins carry a static campaign identifier parameter (txid=<32-hex-chars>&bmodule), suggesting the operator tracks infected hosts or campaigns via a fixed token embedded in the beacon URL.
This technique mirrors the broader EtherHiding trend GTIG/Mandiant have tracked since late 2023 against UNC5142 (a financially motivated actor abusing BNB Smart Chain/Polygon contracts to serve JavaScript-based info-stealer loaders from nearly 14,000 compromised WordPress pages as of mid-2025, evolving from a single-contract to a three-contract Router-Logic-Storage architecture for operational agility) and the related UNC5342 cluster, which embeds payloads in transaction calldata rather than contract storage. No CVE is associated with this activity — it is a social-engineering-driven implant deployment, not an exploited vulnerability.
MITRE ATT&CK techniques used in TL-2026-1670
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1573.002 Asymmetric Cryptography
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.002 Malicious File
Discovery
T1082 System Information Discovery
Persistence
Privilege Escalation
Initial Access
T1566.003 Spearphishing via Service
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts; T1587.001 Malware
Reconnaissance
defense-impairment
Affected products and versions in EtherHiding on macOS
- Apple — macOS
Vulnerable versions: all versions supporting Launch Agents and osascript
Remediation for EtherHiding on macOS
Immediate actions
- Block/alert on macOS processes issuing eth_call JSON-RPC requests to public blockchain RPC providers (polygon.drpc.org, polygon.publicnode.com, polygon-mainnet.gateway.tatum.io, tenderly.rpc.polygon.community) from non-developer/non-Web3 hosts.
- Alert on base64-decoded output piped directly into osascript (base64 -d | osascript pattern).
- Enumerate and review all ~/Library/LaunchAgents/com.*.plist files with RunAtLoad+KeepAlive+hourly StartInterval and randomly generated labels.
- Isolate and forensically image any host where a user reports executing a shell script or command during a video-call 'technical interview' or 'coding assessment'.
- Block outbound resolution/connections to the confirmed rotating C2 domains and flag the smart contract address 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 and operator wallet 0x363aeaf1f67f1fb7abddc3f9806a301f1c64abe3 in network/EDR watchlists.
Workarounds
- Restrict outbound access to public blockchain RPC endpoints at the network egress layer for hosts that have no legitimate Web3/crypto business need.
Longer-term hardening
- Deploy EDR coverage for macOS LaunchAgent/LaunchDaemon creation and Unix-shell-to-AppleScript execution chains (T1543.001, T1059.002, T1059.004).
- Train recruiting-adjacent staff (engineering candidates, hiring managers) on Contagious Interview tradecraft — never execute recruiter-supplied scripts, packages, or 'coding assessment' commands outside a sandboxed/disposable environment.
- Establish organizational policy prohibiting execution of externally supplied code during video interviews/screen-shares; route candidate assessments through vetted, sandboxed coding-assessment platforms only.
- Build detection content for the general EtherHiding/dead-drop-resolver pattern (unauthenticated eth_call from endpoint processes) since this is a reusable, actor-agnostic C2 technique across UNC5142/UNC5342 and DPRK clusters.
Timeline of EtherHiding on macOS
- Operator deploys the Polygon smart contract at 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0, writing test/decoy values to validate the getter/setter mechanism before operational use.
- First operational C2 domain is written to the smart contract, marking the start of active EtherHiding-based C2 for this implant.
- Most recent operational C2 domain observed prior to analysis, consistent with the roughly-weekly (recently accelerating) rotation cadence.
- Contract re-queried post-analysis; a new, previously unseen C2 domain (67sixcebeh.surf) is confirmed as the current getter response.
- Malpedia catalogs the EtherHiding macOS library entry citing Prophet Security's research.
- Prophet Security's autonomous SOC platform reconstructs the complete attack chain and publishes technical analysis, including Sigma and YARA detection content.
- Implant issues read-only eth_call requests (getter selector 0x2686ecea) to public Polygon RPC providers to resolve the current C2 domain from contract storage, then pipes the fetched second-stage payload into osascript.
- Malicious shell script writes a Launch Agent plist to ~/Library/LaunchAgents/com.<random-string>.plist with RunAtLoad, KeepAlive, and an hourly StartInterval.
- Victim joins an AWS Chime meeting posing as a technical interview and shortly afterward downloads and executes a malicious shell script, establishing initial access.
Sources cited for EtherHiding on macOS
- EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain
- Malpedia: EtherHiding macOS library entry
- New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
- Potential Etherhiding C2 via Blockchain Connection (prebuilt detection rule)
- Hunting EtherHiding: Uncovering Unknown Blockchain Malware
- EtherHiding: How Web3 Infrastructure Enables Stealthy Malware Distribution
- Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites
- North Korean threat actors turn blockchains into malware delivery servers
- Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver BeaverTail, InvisibleFerret, and OtterCookie
- Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware
- Contagious Interview: Malware delivered through fake developer job interviews
- Contagious Interview malware in SVG images: DPRK campaign
Detection coverage for TL-2026-1670
As of 2026-07-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1670 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1670
15 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.