# ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT, Infostealer, and Malicious Chrome Extension — DPRK Wallet Trail Exposed

> A DPRK-linked ClickFix campaign impersonates a frozen macOS 'Installing System Update' screen to trick victims into pasting a clipboard-hijacked command into Terminal, which deploys a Node.js RAT (v1.0.3), a 157-wallet infostealer, and a sideloaded malicious 'Google Drive Offline' Chrome extension. Both implants resolve their C2 addresses via EtherHiding (XOR-decoded configs stored in Ethereum smart contracts). On-chain tracing links the operation to UNC5342/Contagious Interview and a KuCoin-funded treasury that moved 464.80 ETH (~$890,000) across 281 transfers between 28 May and 30 July 2026.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1800
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-dprk-clickfix-etherhiding-wallet-trail-tl-2026-1800.webp?v=e562661a (Threadlinqs threat intel: UNC5342 ClickFix Campaign Wallet Trail: Detection & IOCs (TL-2026-1800) — High severity, 26 IOCs, 9 detection rules.)
- **ID:** TL-2026-1800
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UNC5342 (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

This campaign combines the ClickFix social-engineering technique with EtherHiding, a blockchain-based command-and-control method first documented by Google Threat Intelligence Group (GTIG) in October 2025 as a tool of the DPRK threat cluster UNC5342 (aka CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, Void Dokkaebi), operating under the broader 'Contagious Interview' umbrella publicly tracked since February 2025.

Victims land on the lure — reported delivery paths include malvertising via sponsored search results (e.g., decoy 'electrophoresis machine' product searches) — and are shown a full-screen, browser-rendered fake macOS 'Installing System Update / reboot' overlay that locks out normal interaction. Before the victim can act, the page silently copies a base64-encoded attack command to the clipboard and instructs the user to open Terminal and paste it (the ClickFix pattern, MITRE T1204.004). Executing the pasted command (via curl) fetches next-stage malware from the delivery domain real-tumble.pro.

The payload is a ~38KB obfuscated Node.js backdoor (v1.0.3) that establishes persistence via a per-victim LaunchAgent (~/Library/LaunchAgents/com.<random>.plist), a modified .zshrc shell profile, and hidden staging files under ~/Library/Caches/<random> and /tmp/<random>. To resolve its C2 endpoint, the implant performs read-only eth_call requests across roughly 20 public Ethereum RPC endpoints against a smart contract (0x2acA749b59529f5CBCd6fbd34B35b1A546713dF6), invoking a getter function (selector 0x3bc5de30) that returns a base64 blob the implant XOR-decodes (key 9f10d0899beff7952f586a49305f8b14) into a {url, key} C2 definition currently pointing at https://rg-telemetry.sbs/api. The backdoor beacons roughly every 5 minutes, executes attacker-supplied JavaScript via eval(), and returns output over an encrypted channel — giving the operator arbitrary remote code execution with no conventional, seizable C2 server to take down.

A second-stage infostealer module harvests data from Chrome, Brave, Edge, Firefox, Opera, and Vivaldi (saved passwords, cookies, autofill/payment data), 157 desktop and browser-extension cryptocurrency wallets (including MetaMask- and Phantom-class wallets), SSH private keys, AWS and Azure credentials, npm registry tokens, and Foundry (Ethereum dev tooling) keystores — a target list clearly aimed at developer and crypto-operator machines.

A malicious Chrome MV3 extension disguised as 'Google Drive Offline' is sideloaded by directly patching Chrome's Secure Preferences file (bypassing the normal extension-installation UI/consent flow), giving the operator persistent browser access to drain wallets and intercept session data. It resolves its own C2 (https://th-updates.sbs/analytics) via a second EtherHiding contract (0x85a6d913aaC80286f01Fa082ef0B96C188673043, XOR key 2752df77aeb348657f5fb59a22d65f4a) using the same read-only eth_call/getter pattern.

On-chain analysis of the attacker's Ethereum treasury shows funder wallets 0x277765FB63601cE5A9814daf68aA2A57F54eA968 and 0x89c5151236De544d077fC69813A4db89224EE8A1 feeding treasury wallets 0xdf16a4d0a234a2bbc4d21645d4c7a19d2db8f192 and 0x75ac1ebf164c6f2ac24e73bb4c9518b8d93559e2. Separately, researchers traced the KuCoin '17' hot wallet (0x45300136662dd4e58fc0df61e6290dffd992b785) sending 464.80 ETH (~$890,000) across 281 transfers between 28 May and 30 July 2026 into this network with nothing returned — roughly 45% of everything the treasury received before being drained, and part of a broader ~$1.96M movement over nine weeks. A related funding leg was seeded from Binance USDT withdrawals into a laundering cluster publicly tagged by block explorers as 'Fake_Phishing2114928', which is saturated with address-poisoning spam (homoglyph DAI impostor contracts, zero-value transfers, lookalike addresses) consistent with DPRK laundering tradecraft.

This activity extends UNC5342's toolkit beyond the JADESNOW (JavaScript downloader) / INVISIBLEFERRET (Python/JavaScript backdoor) / BEAVERTAIL (second-stage stealer) chain that GTIG originally documented in October 2025, and beyond the fake-recruiter/job-interview lure (fabricated firms like BlockNovas LLC, Angeloper Agency, SoftGlide LLC) into a malvertising-driven, macOS-focused ClickFix delivery chain using a purpose-built Node.js RAT. Despite the decentralization pitch of EtherHiding, the technique still depends on centralized, blockable chokepoints — public RPC providers and block-explorer APIs — which is the primary mitigation lever available to defenders.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1587.001 Malware
- T1608.001 Upload Malware
- T1189 Drive-by Compromise
- T1204.004 Malicious Copy and Paste
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1543.001 Launch Agent
- T1546.004 Unix Shell Configuration Modification
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1027.010 Command Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1564.001 Hidden Files and Directories
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1539 Steal Web Session Cookie
- T1217 Browser Information Discovery
- T1083 File and Directory Discovery
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**macOS LaunchAgent, Shell-Profile, and Hidden Cache Persistence Chain** (`TL-2026-1800-SPL-002`)

Detects creation of a per-victim LaunchAgent plist under ~/Library/LaunchAgents/com.<random>.plist not matching a known vendor bundle ID, a modification of ~/.zshrc, or creation of a hidden randomly-named staging directory under ~/Library/Caches or /tmp -- the full persistence chain documented for the UNC5342 Node.js RAT.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1543.001, T1546.004, T1564.001, T1027
- **Data sources:** osquery:file_events, macos_fsevents, edr_file_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=osquery sourcetype=osquery:file_events earliest=-24h
| eval is_launchagent=if(match(target_path,"(?i)/Library/LaunchAgents/com\.[a-z0-9]+\.plist$") AND NOT match(target_path,"(?i)com\.(apple|google|microsoft|adobe)\."),1,0)
| eval is_shellprofile=if(match(target_path,"(?i)/\.zshrc$"),1,0)
| eval is_hidden_cache=if(match(target_path,"(?i)/Library/Caches/[a-zA-Z0-9]{6,}$") OR match(target_path,"(?i)^/tmp/[a-zA-Z0-9]{6,}$"),1,0)
| where is_launchagent=1 OR is_shellprofile=1 OR is_hidden_cache=1
| stats count values(target_path) as paths by host username is_launchagent is_shellprofile is_hidden_cache
| where count>0
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where (FolderPath has "/Library/LaunchAgents/" and FileName matches regex @"^com\.[a-z0-9]+\.plist$" and not(FileName has_any ("com.apple.","com.google.","com.microsoft.")))
    or FileName == ".zshrc"
    or (FolderPath has "/Library/Caches/" and FileName matches regex @"^[a-zA-Z0-9]{6,}$")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, InitiatingProcessFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: Suspicious macOS LaunchAgent, Shell Profile, or Hidden Cache Persistence Artifact
id: 6f1a2e3c-8b4d-4a1e-9c2f-1a2b3c4d5e04
status: experimental
description: Detects creation of a per-victim LaunchAgent plist under ~/Library/LaunchAgents/com.<random>.plist not matching a known vendor bundle ID, a modification of ~/.zshrc, or creation of a hidden randomly-named staging directory under ~/Library/Caches or /tmp -- the persistence chain documented for the UNC5342 Node.js RAT.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/31
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1543.001
    - attack.t1546.004
    - attack.t1564.001
    - attack.t1027
logsource:
    product: macos
    category: file_event
detection:
    selection_launchagent:
        TargetFilename|contains: '/Library/LaunchAgents/com.'
        TargetFilename|endswith: '.plist'
    filter_known_vendor:
        TargetFilename|contains:
            - 'com.apple.'
            - 'com.google.'
            - 'com.microsoft.'
    selection_shellprofile:
        TargetFilename|endswith: '/.zshrc'
    selection_hidden_cache:
        TargetFilename|re: '.*/Library/Caches/[a-zA-Z0-9]{6,}$'
    condition: (selection_launchagent and not filter_known_vendor) or selection_shellprofile or selection_hidden_cache
falsepositives:
    - Legitimate third-party applications registering their own LaunchAgents with non-obvious bundle identifiers
    - Normal .zshrc edits by the user or a package manager (Homebrew, nvm, pyenv)
level: high
```

**Known false positives:**

- Legitimate third-party applications registering their own LaunchAgents with non-obvious bundle identifiers
- Normal .zshrc edits by the user or a package manager (Homebrew, nvm, pyenv)

**Tuning notes:** Maintain an allow-list of known-legitimate LaunchAgent bundle-ID prefixes (Homebrew, JetBrains, Docker, etc.) beyond the built-in Apple/Google/Microsoft filter; correlate a shell-profile edit occurring within minutes of a browser-spawned Terminal paste (SPL/SIG-001) to sharply raise confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Malvertising-Driven Network Contact to ClickFix Delivery Domain or DPRK Sibling Infrastructure (locked: unlock with TL Creds)
- Chrome Secure Preferences Tampered Outside Normal Extension Install Flow (locked: unlock with TL Creds)
- Node.js Process Beaconing to Known EtherHiding C2 Domains or DPRK Community-Sibling Infrastructure (locked: unlock with TL Creds)
- Curl Fetch of Next-Stage Payload from ClickFix Delivery Domain (locked: unlock with TL Creds)
- Bulk Access to Browser Credential Stores, SSH Keys, Cloud Credentials, and Crypto Wallets by a Single Process (locked: unlock with TL Creds)
- Node.js Process Executing Dynamic eval() of Network-Retrieved Code (locked: unlock with TL Creds)
- ClickFix Terminal Paste-Execute — Base64 Decode Pipeline to [indicator] (locked: unlock with TL Creds)
- EtherHiding Read-Only eth_call to Known Smart Contract (Blockchain Dead-Drop C2 Resolution) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- Domain: `real-tumble[.]pro`
- File hash: `529815d365a8ec8da165f3993ada3ad452381b56c736cd25cdf328968b4ab795`
- Domain: `rg-telemetry[.]sbs`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ClickFix Campaign Uses EtherHiding to Hide Malware and Exposes DPRK Wallet Trail](https://gbhackers.com/clickfix-campaign-uses-etherhiding/)
- [ClickFix, EtherHiding & a DPRK Wallet Trail](https://www.allsecure.io/blog/clickfix-etherhiding-dprk-wallet/)
- [DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware](https://thehackernews.com/2026/07/dprk-linked-macos-malvertising-uses.html)
- [North Korean EtherHiding Campaign Targets Crypto Wallets and Developer Credentials](https://cybersecuritynews.com/north-korean-etherhiding-campaign/)
- [DPRK adopts EtherHiding](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [North Korean hackers use EtherHiding to hide malware on the blockchain](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [DPRK Hackers Use 'EtherHiding' to Host Malware on Ethereum, BNB Blockchains: Google](https://decrypt.co/345139/dprk-hackers-use-etherhiding-to-host-malware-on-ethereum-bnb-blockchains-google)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1800