EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix Backdoor + Banking-Trojan Extension Campaign Adopted by Criminal, North Korean, and Iran-Linked Actors — Threadlinqs Intelligence
As of 2026-09-01, EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix Backdoor + Banking-Trojan Extension Campaign Adopted by Criminal, North Korean, and Iran-Linked Actors is a high-severity malware threat attributed to multiple clusters (criminal EtherHiding operators since 2023 (North Korea, Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-2273 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: multiple clusters (criminal EtherHiding operators since 2023 · North Korea, Iran · FINANCIAL
EtherHiding is a command-and-control technique that stores dynamically updatable C2 addresses inside a Polygon blockchain smart contract, letting operators rotate infected machines to new
EtherHiding turns a public blockchain into a decentralized "dead drop resolver": rather than hardcoding a C2 domain or IP that defenders can sinkhole, the malware queries a smart contract deployed on Polygon (and, in earlier/related campaigns, BNB Smart Chain and Ethereum) to retrieve the current C2 address. Because updating the pointer is just a blockchain transaction costing fractions of a cent, operators can rotate infrastructure indefinitely, and because the ledger is immutable and has no single controlling entity, there is no registrar, hosting provider, or court order that can take it offline. The same immutability is a double-edged sword for the attackers: every pointer update is permanently and publicly visible on-chain, which lets investigators reconstruct operational history using free, public blockchain data.
The technique was first documented in October 2023 by Guardio Labs as a component of the financially motivated ClearFake campaign (tracked by Google as UNC5142), which embedded malicious JavaScript loader logic in BNB Smart Chain smart contracts behind fake browser-update overlays. In 2025, Google Threat Intelligence Group (GTIG) reported the first state-sponsored adoption: North Korean threat cluster UNC5342 (aka DeceptiveDevelopment/Famous Chollima/Void Dokkaebi), operating the "Contagious Interview" fake-recruiter social-engineering campaign, began embedding EtherHiding pointers in BNB Smart Chain and Ethereum smart contracts from around February 2025 to serve the BeaverTail/JADESNOW/InvisibleFerret malware chain to developers, updating the contract over 20 times in four months.
The campaign specifically documented in this record (GuidePoint Security, published 2026-09-01) is a distinct but related development: EtherHiding hosted on the Polygon blockchain, delivered through a "ClickFix" infection chain. Victims land on at least 31 compromised legitimate business websites (e-commerce, professional services, retail logistics) that display a fake "Verify you're human" CAPTCHA instructing them to paste and run a PowerShell command. Two obfuscation variants were observed: a string-replace obfuscation pattern (`$a="1i1e1x2i1r1m1" -replace 1 -split 2`) and direct invocation via `[System.Management.Automation.PowerShell]::Create()`. The resulting single-paste action silently installs a backdoor that persists across reboots via an `HKCU` Run-key value named `PersonalizedUpdates` and a scheduled task named `Enter` that beacons to C2 every 60 seconds; beacon traffic is XOR-obfuscated with the key `!sdf$&G321`, and victim machines are fingerprinted using the `MachineGuid` registry value. The backdoor resolves its current C2 domain by querying a Polygon smart contract through public RPC endpoints (publicnode, Tenderly, 1RPC, OnFinality, Subquery, dRPC, Lava) rather than a hardcoded address.
A second payload is a banking-trojan browser extension (Chromium extension ID `bpknfkhjjbjgagobdaekmnlgdhbbpcea`, observed under multiple cosmetic display names, communicating with a native messaging host `com.top.index`) that renders web-inject credential-capture panels sourced from attacker-controlled configuration servers to target banking and cryptocurrency platform logins.
Attacker-side infrastructure includes a build/staging server at `onemm[.]net` (origin IP `37.27.52.152`) that was itself compromised using a set of Linux/OpenSSH CISA KEV-listed vulnerabilities: CVE-2023-4911 (Looney Tunables glibc buffer overflow, local privilege escalation), CVE-2023-0386 (Linux kernel OverlayFS improper ownership management, local privilege escalation), CVE-2022-2586 (Linux kernel nf_tables use-after-free, local privilege escalation), CVE-2023-44487 (HTTP/2 Rapid Reset, denial of service), and CVE-2024-6387 (regreSSHion, OpenSSH signal-handler race condition enabling unauthenticated remote code execution). A network of traffic-distribution-system (TDS) domains (`additionalver[.]com`, `promo-chatgpt[.]com`, `pleasewaitcenter[.]top`, `skay
Weaknesses (CWE)
CWE-787, CWE-282, CWE-416, CWE-400, CWE-362
Target sectors: ecommerce, professional services, retail logistics
Timeline
- EtherHiding technique first emerges as part of the financially motivated ClearFake campaign (tracked as UNC5142), embedding malicious JavaScript loader pointers in BNB Smart Chain smart contracts.
- Guardio Labs publishes the first public technical writeup naming and detailing the EtherHiding technique.
- Google Threat Intelligence Group later reports that North Korean threat cluster UNC5342 began embedding EtherHiding C2 pointers in BNB Smart Chain/Ethereum smart contracts around this time as part of the Contagious Interview campaign.
- Google publishes a report attributing EtherHiding use to UNC5342, the first documented state-sponsored adoption of the technique, noting the smart contract was updated over 20 times in four months.
- Per GuidePoint Security, North Korean state actors adopt EtherHiding on the Polygon blockchain specifically for the ClickFix-delivered backdoor and banking-trojan-extension campaign documented in this record (reported as "late 2025").
- Per GuidePoint Security, Iran-linked groups adopt the same Polygon-based EtherHiding C2 technique (reported as "early 2026").
- Several previously cleaned compromised websites are silently re-compromised weeks before the GuidePoint report's publication, indicating an unresolved initial-access vector or renewed targeting.
- GuidePoint Security publishes "EtherHiding Exposed," documenting at least 31 compromised legitimate business websites across e-commerce, professional services, and retail logistics delivering the ClickFix chain, PersonalizedUpdates backdoor, and bpknfkhjjbjgagobdaekmnlgdhbbpcea banking-trojan browser extension.
Detections & IOCs
As of 2026-09-02, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2023-4911, CVE-2023-0386, CVE-2022-2586, CVE-2023-44487, CVE-2024-6387, T1190, T1204.004, T1059.001, T1547.001, T1053.005, T1176, T1027, T1132.002, T1056.003, T1082
