ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT, Infostealer, and Malicious Chrome Extension — DPRK Wallet Trail Exposed

ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT (TL-2026-1800), also tracked as DPRK Wallet Trail EtherHiding Campaign, is a high-severity malware campaign, first published 2026-07-31. It is attributed to UNC5342 (North Korea) with high confidence, affects Apple macOS, maps to 25 MITRE ATT&CK techniques (T1027, T1027.010, T1041), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-1800

Threat ID
TL-2026-1800
Also known as
DPRK Wallet Trail EtherHiding Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-31
Last reviewed
2026-07-31
Attribution
UNC5342
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
cryptocurrency, financial-services, technology, software-development
Target regions
Global
Detection rules
9
Indicators of compromise
26

Malware and tooling in ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT

Malware and tooling: Node.js RAT v1.0.3, Google Drive Offline

A DPRK-linked ClickFix campaign impersonates a frozen macOS 'Installing System Update' screen to trick victims into pasting a clipboard-hijacked command into Terminal, which deploys a Node.js RAT (v1.0.3), a 157-wallet infostealer, and a sideloaded malicious 'Google Drive Offline' Chrome extension. Both implants resolve their C2 addresses via EtherHiding (XOR-decoded configs stored in Ethereum smart contracts). On-chain tracing links the operation to UNC5342/Contagious Interview and a KuCoin-funded treasury that moved 464.80 ETH (~$890,000) across 281 transfers between 28 May and 30 July 2026.

How ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT works

This campaign combines the ClickFix social-engineering technique with EtherHiding, a blockchain-based command-and-control method first documented by Google Threat Intelligence Group (GTIG) in October 2025 as a tool of the DPRK threat cluster UNC5342 (aka CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, Void Dokkaebi), operating under the broader 'Contagious Interview' umbrella publicly tracked since February 2025.

Victims land on the lure — reported delivery paths include malvertising via sponsored search results (e.g., decoy 'electrophoresis machine' product searches) — and are shown a full-screen, browser-rendered fake macOS 'Installing System Update / reboot' overlay that locks out normal interaction. Before the victim can act, the page silently copies a base64-encoded attack command to the clipboard and instructs the user to open Terminal and paste it (the ClickFix pattern, MITRE T1204.004). Executing the pasted command (via curl) fetches next-stage malware from the delivery domain real-tumble.pro.

The payload is a ~38KB obfuscated Node.js backdoor (v1.0.3) that establishes persistence via a per-victim LaunchAgent (~/Library/LaunchAgents/com.<random>.plist), a modified .zshrc shell profile, and hidden staging files under ~/Library/Caches/<random> and /tmp/<random>. To resolve its C2 endpoint, the implant performs read-only eth_call requests across roughly 20 public Ethereum RPC endpoints against a smart contract (0x2acA749b59529f5CBCd6fbd34B35b1A546713dF6), invoking a getter function (selector 0x3bc5de30) that returns a base64 blob the implant XOR-decodes (key 9f10d0899beff7952f586a49305f8b14) into a {url, key} C2 definition currently pointing at https://rg-telemetry.sbs/api. The backdoor beacons roughly every 5 minutes, executes attacker-supplied JavaScript via eval(), and returns output over an encrypted channel — giving the operator arbitrary remote code execution with no conventional, seizable C2 server to take down.

A second-stage infostealer module harvests data from Chrome, Brave, Edge, Firefox, Opera, and Vivaldi (saved passwords, cookies, autofill/payment data), 157 desktop and browser-extension cryptocurrency wallets (including MetaMask- and Phantom-class wallets), SSH private keys, AWS and Azure credentials, npm registry tokens, and Foundry (Ethereum dev tooling) keystores — a target list clearly aimed at developer and crypto-operator machines.

A malicious Chrome MV3 extension disguised as 'Google Drive Offline' is sideloaded by directly patching Chrome's Secure Preferences file (bypassing the normal extension-installation UI/consent flow), giving the operator persistent browser access to drain wallets and intercept session data. It resolves its own C2 (https://th-updates.sbs/analytics) via a second EtherHiding contract (0x85a6d913aaC80286f01Fa082ef0B96C188673043, XOR key 2752df77aeb348657f5fb59a22d65f4a) using the same read-only eth_call/getter pattern.

On-chain analysis of the attacker's Ethereum treasury shows funder wallets 0x277765FB63601cE5A9814daf68aA2A57F54eA968 and 0x89c5151236De544d077fC69813A4db89224EE8A1 feeding treasury wallets 0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192 and 0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2. Separately, researchers traced the KuCoin '17' hot wallet (0x45300136662dd4e58fc0df61e6290dffd992b785) sending 464.80 ETH (~$890,000) across 281 transfers between 28 May and 30 July 2026 into this network with nothing returned — roughly 45% of everything the treasury received before being drained, and part of a broader ~$1.96M movement over nine weeks. A related funding leg was seeded from Binance USDT withdrawals into a laundering cluster publicly tagged by block explorers as 'Fake_Phishing2114928', which is saturated with address-poisoning spam (homoglyph DAI impostor contracts, zero-value transfers, lookalike addresses) consistent with DPRK laundering tradecraft.

This activity extends UNC5342's toolkit beyond the JADESNOW (JavaScript downloader) / INVISIBLEFERRET (Python/JavaScript backdoor) / BEAVERTAIL (second-stage stealer) chain that GTIG originally documented in October 2025, and beyond the fake-recruiter/job-interview lure (fabricated firms like BlockNovas LLC, Angeloper Agency, SoftGlide LLC) into a malvertising-driven, macOS-focused ClickFix delivery chain using a purpose-built Node.js RAT. Despite the decentralization pitch of EtherHiding, the technique still depends on centralized, blockable chokepoints — public RPC providers and block-explorer APIs — which is the primary mitigation lever available to defenders.

MITRE ATT&CK techniques used in TL-2026-1800

Defense Evasion

T1027 Obfuscated Files or Information; T1027.010 Command Obfuscation; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Unix Shell; T1059.007 JavaScript; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1573 Encrypted Channel

Discovery

T1083 File and Directory Discovery; T1217 Browser Information Discovery

Persistence

T1176 Software Extensions; T1543.001 Launch Agent; T1546.004 Unix Shell Configuration Modification

Initial Access

T1189 Drive-by Compromise

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1583.008 Malvertising; T1587.001 Malware; T1608.001 Upload Malware

Impact

T1657 Financial Theft

Affected products and versions in ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT

  • Apple — macOS
    Vulnerable versions: All supported versions (social-engineering delivery via ClickFix; not a software vulnerability)
  • Google — Google Chrome
    Vulnerable versions: All versions supporting Manifest V3 extensions and Secure Preferences (sideloading abuse; not a software vulnerability)

Remediation for ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT

Immediate actions

  • Block the delivery and C2 domains at DNS/proxy/perimeter: real-tumble.pro, rg-telemetry.sbs, th-updates.sbs
  • Hunt for and remove unauthorized LaunchAgents matching ~/Library/LaunchAgents/com.*.plist, modified .zshrc entries, and staging files under ~/Library/Caches/<random> and /tmp/<random>
  • Audit installed Chrome extensions and Secure Preferences integrity for any 'Google Drive Offline' or other unrecognized sideloaded MV3 extension not installed via the Chrome Web Store
  • Rotate/revoke any SSH keys, AWS/Azure credentials, npm tokens, and Foundry keystores present on machines that may have executed a pasted Terminal command from a browser prompt
  • Move funds out of and treat as compromised any cryptocurrency wallet (of the 157 targeted families, including MetaMask/Phantom-class wallets) present on an affected machine

Workarounds

  • Block or restrict access to public Ethereum JSON-RPC endpoints and blockchain explorer APIs (Etherscan/BscScan/Ethplorer-class services) from developer endpoints where feasible, since EtherHiding depends on these centralized chokepoints despite the decentralized hosting of the payload
  • Enforce Chrome DownloadRestrictions and URLBlocklist policies plus enhanced Safe Browsing mode to reduce ClickFix/malvertising landing-page exposure

Longer-term hardening

  • Train users — especially developers and crypto-adjacent staff — that no legitimate OS update or software installer ever asks them to paste a command into Terminal
  • Deploy EDR/behavioral detection for eval()-based remote code execution in Node.js processes and for high-frequency outbound beaconing to public blockchain RPC endpoints
  • Monitor for read-only eth_call traffic to known-malicious or newly-flagged smart contract addresses as a C2 detection signal
  • Enforce Chrome Enterprise policies restricting unmanaged extension sideloading and Secure Preferences tampering
  • Establish a blockchain-IOC feed (malicious contract addresses) alongside traditional domain/IP/hash feeds for detection engineering

Timeline of ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT

  • Google Threat Intelligence Group observes DPRK cluster UNC5342 begin employing EtherHiding within Contagious Interview operations, the first documented nation-state use of the technique.
  • Per GTIG's original disclosure, UNC5342's early EtherHiding smart contracts were updated over 20 times within four months at an average gas cost of ~$1.37 per update, demonstrating the operational agility of blockchain-hosted C2 later reused in this campaign's infrastructure.
  • Google Threat Intelligence Group publicly discloses the EtherHiding technique and attributes it to DPRK threat cluster UNC5342, detailing the JADESNOW/INVISIBLEFERRET/BEAVERTAIL toolchain.
  • Microsoft Security publishes research on a related ClickFix campaign using fake macOS utility lures to deliver infostealers, consistent with the broader DPRK ClickFix pivot toward macOS targeting.
  • First of 281 tracked transfers begins moving from the KuCoin '17' hot wallet (0x45300136662dd4e58fc0df61e6290dffd992b785) into the attacker-controlled treasury network.
  • The Hacker News reports on the DPRK-linked macOS malvertising campaign delivering the Node.js backdoor, 157-wallet infostealer, and 'Google Drive Offline' malicious extension.
  • AllSecure researchers publish the original technical analysis tying this ClickFix/EtherHiding campaign's Node.js RAT and Chrome extension infrastructure to the DPRK on-chain wallet trail.
  • Tracing concludes that 464.80 ETH (~$890,000) moved across 281 transfers since 28 May 2026 — roughly 45% of everything the treasury received — with none of it returned, as part of a broader ~$1.96M movement over nine weeks.
  • GBHackers publishes coverage of the campaign, summarizing the EtherHiding C2 mechanics and the exposed DPRK wallet trail.

Sources cited for ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT

Threats related to ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT

Detection coverage for TL-2026-1800

As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1800 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats