Threat reportMalwareTL-2026-2273
EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix Backdoor + Banking-Trojan Extension Campaign Adopted by Criminal, North Korean, and Iran-Linked Actors
EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix (TL-2026-2273), also tracked as EtherHiding, is a high-severity malware campaign, first published 2026-09-01. It is linked to a North Korea, Iran-nexus actor with low confidence, affects Various (compromised legitimate businesses) Public-facing e-commerce, references 5 CVEs (CVE-2023-4911, CVE-2023-0386, CVE-2022-2586), maps to 14 MITRE ATT&CK techniques (T1027, T1053.005, T1056.003), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-2273
- Threat ID
- TL-2026-2273
- Also known as
- EtherHiding
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Nation-state nexus
- North Korea, Iran
- Motivation
- FINANCIAL
- Target sectors
- ecommerce, professional services, retail logistics
- Detection rules
- 9
- Indicators of compromise
- 30
How EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix works
EtherHiding is a command-and-control technique that stores dynamically updatable C2 addresses inside a Polygon blockchain smart contract, letting operators rotate infected machines to new infrastructure for fractions of a cent while defeating conventional domain/IP takedown. First used by criminal groups in 2023 (as part of the ClearFake campaign), it has since been adopted by North Korean state actors (late 2025) and Iran-linked groups (early 2026); a campaign documented by GuidePoint Security compromised at least 31 legitimate e-commerce, professional-services, and retail-logistics websites via fake-CAPTCHA ("ClickFix") PowerShell paste-and-run lures that deploy a reboot-persistent backdoor and a banking-trojan browser extension.
EtherHiding turns a public blockchain into a decentralized "dead drop resolver": rather than hardcoding a C2 domain or IP that defenders can sinkhole, the malware queries a smart contract deployed on Polygon (and, in earlier/related campaigns, BNB Smart Chain and Ethereum) to retrieve the current C2 address. Because updating the pointer is just a blockchain transaction costing fractions of a cent, operators can rotate infrastructure indefinitely, and because the ledger is immutable and has no single controlling entity, there is no registrar, hosting provider, or court order that can take it offline. The same immutability is a double-edged sword for the attackers: every pointer update is permanently and publicly visible on-chain, which lets investigators reconstruct operational history using free, public blockchain data.
The technique was first documented in October 2023 by Guardio Labs as a component of the financially motivated ClearFake campaign (tracked by Google as UNC5142), which embedded malicious JavaScript loader logic in BNB Smart Chain smart contracts behind fake browser-update overlays. In 2025, Google Threat Intelligence Group (GTIG) reported the first state-sponsored adoption: North Korean threat cluster UNC5342 (aka DeceptiveDevelopment/Famous Chollima/Void Dokkaebi), operating the "Contagious Interview" fake-recruiter social-engineering campaign, began embedding EtherHiding pointers in BNB Smart Chain and Ethereum smart contracts from around February 2025 to serve the BeaverTail/JADESNOW/InvisibleFerret malware chain to developers, updating the contract over 20 times in four months.
The campaign specifically documented in this record (GuidePoint Security, published 2026-09-01) is a distinct but related development: EtherHiding hosted on the Polygon blockchain, delivered through a "ClickFix" infection chain. Victims land on at least 31 compromised legitimate business websites (e-commerce, professional services, retail logistics) that display a fake "Verify you're human" CAPTCHA instructing them to paste and run a PowerShell command. Two obfuscation variants were observed: a string-replace obfuscation pattern (`$a="1i1e1x2i1r1m1" -replace 1 -split 2`) and direct invocation via `[System.Management.Automation.PowerShell]::Create()`. The resulting single-paste action silently installs a backdoor that persists across reboots via an `HKCU` Run-key value named `PersonalizedUpdates` and a scheduled task named `Enter` that beacons to C2 every 60 seconds; beacon traffic is XOR-obfuscated with the key `!sdf$&G321`, and victim machines are fingerprinted using the `MachineGuid` registry value. The backdoor resolves its current C2 domain by querying a Polygon smart contract through public RPC endpoints (publicnode, Tenderly, 1RPC, OnFinality, Subquery, dRPC, Lava) rather than a hardcoded address.
A second payload is a banking-trojan browser extension (Chromium extension ID `bpknfkhjjbjgagobdaekmnlgdhbbpcea`, observed under multiple cosmetic display names, communicating with a native messaging host `com.top.index`) that renders web-inject credential-capture panels sourced from attacker-controlled configuration servers to target banking and cryptocurrency platform logins.
Attacker-side infrastructure includes a build/staging server at `onemm[.]net` (origin IP `37.27.52.152`) that was itself compromised using a set of Linux/OpenSSH CISA KEV-listed vulnerabilities: CVE-2023-4911 (Looney Tunables glibc buffer overflow, local privilege escalation), CVE-2023-0386 (Linux kernel OverlayFS improper ownership management, local privilege escalation), CVE-2022-2586 (Linux kernel nf_tables use-after-free, local privilege escalation), CVE-2023-44487 (HTTP/2 Rapid Reset, denial of service), and CVE-2024-6387 (regreSSHion, OpenSSH signal-handler race condition enabling unauthenticated remote code execution). A network of traffic-distribution-system (TDS) domains (`additionalver[.]com`, `promo-chatgpt[.]com`, `pleasewaitcenter[.]top`, `skaybolt[.]online`, `lanhd6549tdhse[.]top`) and dedicated ClickFix delivery domains feed victims to the compromised sites and payload stages.
GuidePoint reports that several previously cleaned websites were silently re-compromised weeks later, indicating either an unpatched initial-access vector or renewed targeting, and that at least 31 organizations across e-commerce, professional services, and retail logistics have been affected as of publication. No single named threat-actor cluster is confirmed for this specific Polygon-based, ClickFix-delivered campaign; GuidePoint attributes it generically to criminal operators joined by North Korean state actors since late 2025 and Iran-linked groups since early 2026, distinct from (though thematically related to) UNC5342's separately documented BSC/Ethereum EtherHiding use in Contagious Interview.
MITRE ATT&CK techniques used in TL-2026-2273
Defense Evasion
T1027 Obfuscated Files or Information
Persistence
T1053.005 Scheduled Task; T1176 Software Extensions; T1547.001 Registry Run Keys / Startup Folder
Credential Access
Execution
T1059.001 PowerShell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver
Discovery
T1082 System Information Discovery
command-and-control
T1132.002 Non-Standard Encoding
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
Affected products and versions in EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix
- Various (compromised legitimate businesses) — Public-facing e-commerce, professional-services, and retail-logistics websites
Vulnerable versions: 31+ confirmed compromised sites as of 2026-09-01, including recurring re-compromise after cleanup
Fixed in: Not applicable - requires incident-response remediation, root-cause patching, and continuous re-audit - Linux kernel / GNU glibc / OpenSSH — Attacker build/staging origin server (onemm[.]net, 37.27.52.152)
Vulnerable versions: Unpatched Linux hosts affected by CVE-2023-4911, CVE-2023-0386, CVE-2022-2586, CVE-2023-44487, and CVE-2024-6387
Fixed in: Patched per each CVE's respective vendor advisory - Google Chrome / Microsoft Edge (Chromium) — Browser extension platform - malicious extension ID bpknfkhjjbjgagobdaekmnlgdhbbpcea
Vulnerable versions: Any Chromium-based browser with the malicious extension installed
Fixed in: N/A - requires extension removal / enterprise policy block
Remediation for EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix
Patches
- Patch Linux origin/staging servers against CVE-2023-4911 (Looney Tunables), CVE-2023-0386 (OverlayFS), CVE-2022-2586 (nf_tables UAF), CVE-2023-44487 (HTTP/2 Rapid Reset), and CVE-2024-6387 (regreSSHion) per vendor advisories
Immediate actions
- Block the enumerated delivery, C2, and TDS domains/IP at DNS and perimeter proxy layers
- Hunt for the 'PersonalizedUpdates' HKCU Run-key value and the 'Enter' scheduled task on Windows endpoints
- Force-remove/blocklist Chromium extension ID bpknfkhjjbjgagobdaekmnlgdhbbpcea across the fleet via enterprise browser policy
- Audit public-facing websites (CMS admin panels, plugins, server software) for injection/compromise indicators consistent with the fake-CAPTCHA/ClickFix overlay
Workarounds
- Where patching is delayed, restrict local access on affected Linux servers and disable/limit HTTP/2 to reduce Rapid Reset exposure
Longer-term hardening
- Shift detection from static IOCs to behavioral signatures (DGA-style delivery domains, ASN clustering, newly registered domains) since blockchain-hosted C2 pointers can rotate for fractions of a cent
- Deploy EDR coverage for PowerShell paste-and-run (ClickFix / T1204.004) behavior and clipboard-triggered command execution
- Restrict unapproved browser extension installation via enterprise/organizational policy
- Add ClickFix/fake-CAPTCHA as a distinct category in security-awareness training
- Continuously (not one-time) re-audit previously cleaned websites - the campaign shows a re-compromise pattern weeks after remediation
CVEs associated with EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix
CVE-2023-4911, CVE-2023-0386, CVE-2022-2586, CVE-2023-44487, CVE-2024-6387
Weaknesses (CWE) in EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix
Timeline of EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix
- EtherHiding technique first emerges as part of the financially motivated ClearFake campaign (tracked as UNC5142), embedding malicious JavaScript loader pointers in BNB Smart Chain smart contracts.
- Guardio Labs publishes the first public technical writeup naming and detailing the EtherHiding technique.
- Google Threat Intelligence Group later reports that North Korean threat cluster UNC5342 began embedding EtherHiding C2 pointers in BNB Smart Chain/Ethereum smart contracts around this time as part of the Contagious Interview campaign.
- Google publishes a report attributing EtherHiding use to UNC5342, the first documented state-sponsored adoption of the technique, noting the smart contract was updated over 20 times in four months.
- Per GuidePoint Security, North Korean state actors adopt EtherHiding on the Polygon blockchain specifically for the ClickFix-delivered backdoor and banking-trojan-extension campaign documented in this record (reported as "late 2025").
- Per GuidePoint Security, Iran-linked groups adopt the same Polygon-based EtherHiding C2 technique (reported as "early 2026").
- Several previously cleaned compromised websites are silently re-compromised weeks before the GuidePoint report's publication, indicating an unresolved initial-access vector or renewed targeting.
- GuidePoint Security publishes "EtherHiding Exposed," documenting at least 31 compromised legitimate business websites across e-commerce, professional services, and retail logistics delivering the ClickFix chain, PersonalizedUpdates backdoor, and bpknfkhjjbjgagobdaekmnlgdhbbpcea banking-trojan browser extension.
Sources cited for EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix
- EtherHiding Exposed: What Security Leaders Need to Know
- North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
- North Korean hackers use EtherHiding to hide malware on the blockchain
- DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains
- Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign
- EtherHiding - Hiding Web2 Malicious Code in Web3 Smart Contracts
- ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims
- Malicious Copy and Paste (T1204.004) - MITRE ATT&CK
- NVD - CVE-2023-4911 (Looney Tunables)
- NVD - CVE-2023-0386 (OverlayFS)
- NVD - CVE-2022-2586 (nf_tables UAF)
- NVD - CVE-2023-44487 (HTTP/2 Rapid Reset)
- NVD - CVE-2024-6387 (regreSSHion)
Detection coverage for TL-2026-2273
As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2273 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.