# EtherHiding on macOS: Blockchain-Resolved C2 via Polygon Smart Contract

> A persistent macOS Launch Agent implant, delivered via a fake technical-interview lure over AWS Chime, resolves its command-and-control domain by issuing read-only eth_call requests to a Polygon smart contract (the EtherHiding dead-drop-resolver technique) and decoding the returned hex value into a beacon domain that rotates roughly weekly.

- **Published:** 2026-07-24T00:00:00Z
- **Last reviewed:** 2026-07-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1670
- **ID:** TL-2026-1670
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In July 2026, Prophet Security's autonomous SOC platform reconstructed the complete attack chain of a macOS implant that uses the EtherHiding technique — a class of blockchain dead-drop resolvers first documented by Google Threat Intelligence Group (GTIG)/Mandiant against the financially motivated actor UNC5142, and popularized by DPRK-nexus operators against crypto and Web3 targets — to hide its command-and-control (C2) infrastructure inside a Polygon (Chain ID 137) smart contract at address 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0.

Initial access is assessed with moderate confidence as social engineering consistent with 'Contagious Interview' tradecraft: DPRK-nexus actors have run a sustained campaign since at least December 2022 in which operators pose as recruiters, stage multi-step fake technical interviews, and induce victims to execute attacker-supplied code during a live video call. In this incident, the victim joined an AWS Chime meeting posing as a technical interview and shortly afterward downloaded and executed a malicious shell script.

The shell script wrote a Launch Agent property list to ~/Library/LaunchAgents/com.<random-string>.plist with RunAtLoad and KeepAlive set to true and an hourly StartInterval, giving the implant persistence and re-execution without a dropped binary. Each trigger ran a one-line shell command — /bin/bash -c "echo '<base64>' | base64 -d | osascript" — that decoded a base64 blob into an obfuscated AppleScript payload (with character-code obfuscation to further conceal strings) and executed it via osascript. A daemon-privileged variant was also observed that executes at boot with elevated privileges.

At runtime, the AppleScript issued unauthenticated, read-only eth_call JSON-RPC requests (function selector 0x2686ecea, the getter) against multiple public Polygon RPC providers — polygon.drpc.org, polygon.publicnode.com, polygon-mainnet.gateway.tatum.io, and tenderly.rpc.polygon.community — to read the current C2 domain out of contract storage. Because eth_call reads require no wallet, no gas, and no authentication, and because thousands of independent Polygon full nodes serve the same immutable contract state, this dead-drop resolver is highly resistant to conventional domain/IP takedown: defenders can seize the resolved domain, but the operator simply calls the contract's setter (selector 0xd75d1ba6) to rotate to a fresh one. The hex return value was decoded to an ASCII domain string, fetched over HTTPS, and the response piped directly into osascript for second-stage execution — a fileless chain in which the malicious domain is never resident in any binary or plist on disk.

An operator wallet address (0x363aeaf1f67f1fb7abddc3f9806a301f1c64abe3) was observed writing to the contract; on-chain history shows the contract was deployed on 2026-05-01 with test/decoy values, followed by the first operational C2 domain from 2026-05-18 onward, with domains rotating roughly weekly (with recent acceleration) and the most recent operational domain observed 2026-07-09; a re-query on 2026-07-21 (post-analysis) surfaced an additional unseen domain. Funding-chain analysis traced the deploying/operator wallet through a distribution hub to a wallet carrying a public phishing label, and two operator-linked wallets were found to share a vanity address prefix, consistent with operator tooling reuse across campaigns. Beacon check-ins carry a static campaign identifier parameter (txid=<32-hex-chars>&bmodule), suggesting the operator tracks infected hosts or campaigns via a fixed token embedded in the beacon URL.

This technique mirrors the broader EtherHiding trend GTIG/Mandiant have tracked since late 2023 against UNC5142 (a financially motivated actor abusing BNB Smart Chain/Polygon contracts to serve JavaScript-based info-stealer loaders from nearly 14,000 compromised WordPress pages as of mid-2025, evolving from a single-contract to a three-contract Router-Logic-Storage architecture for operational agility) and the related UNC5342 cluster, which embeds payloads in transaction calldata rather than contract storage. No CVE is associated with this activity — it is a social-engineering-driven implant deployment, not an exploited vulnerability.

## MITRE ATT&CK

- T1589.003 Employee Names
- T1585.001 Social Media Accounts
- T1583.001 Domains
- T1587.001 Malware
- T1566.003 Spearphishing via Service
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1204.002 Malicious File
- T1543.001 Launch Agent
- T1647 Plist File Modification
- T1543.004 Launch Daemon
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1102.001 Dead Drop Resolver
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1008 Fallback Channels

## Sources

- [EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain](https://www.prophetsecurity.ai/blog/etherhiding-malware-macos-blockchain-c2)
- [Malpedia: EtherHiding macOS library entry](https://malpedia.caad.fkie.fraunhofer.de/library/43d4177c-d200-408f-92ff-94bf9313e3b8/)
- [New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware](https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware)
- [Potential Etherhiding C2 via Blockchain Connection (prebuilt detection rule)](https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_potential_etherhiding_c2)
- [Hunting EtherHiding: Uncovering Unknown Blockchain Malware](https://www.vmray.com/threat-intelligence-insights-pivoting-off-the-blockchain/)
- [EtherHiding: How Web3 Infrastructure Enables Stealthy Malware Distribution](https://www.picussecurity.com/resource/blog/etherhiding-how-web3-infrastructure-enables-stealthy-malware-distribution)
- [Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites](https://thehackernews.com/2025/10/hackers-abuse-blockchain-smart.html)
- [North Korean threat actors turn blockchains into malware delivery servers](https://www.csoonline.com/article/4074916/north-korean-threat-actors-turn-blockchains-into-malware-delivery-servers.html)
- [Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver BeaverTail, InvisibleFerret, and OtterCookie](https://www.silentpush.com/blog/contagious-interview-front-companies/)
- [Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [Contagious Interview malware in SVG images: DPRK campaign](https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1670