# EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix Backdoor + Banking-Trojan Extension Campaign Adopted by Criminal, North Korean, and Iran-Linked Actors

> EtherHiding is a command-and-control technique that stores dynamically updatable C2 addresses inside a Polygon blockchain smart contract, letting operators rotate infected machines to new infrastructure for fractions of a cent while defeating conventional domain/IP takedown. First used by criminal groups in 2023 (as part of the ClearFake campaign), it has since been adopted by North Korean state actors (late 2025) and Iran-linked groups (early 2026); a campaign documented by GuidePoint Security compromised at least 31 legitimate e-commerce, professional-services, and retail-logistics websites via fake-CAPTCHA ("ClickFix") PowerShell paste-and-run lures that deploy a reboot-persistent backdoor and a banking-trojan browser extension.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-09-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2273
- **ID:** TL-2026-2273
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-4911, CVE-2023-0386, CVE-2022-2586, CVE-2023-44487, CVE-2024-6387

## Description

EtherHiding turns a public blockchain into a decentralized "dead drop resolver": rather than hardcoding a C2 domain or IP that defenders can sinkhole, the malware queries a smart contract deployed on Polygon (and, in earlier/related campaigns, BNB Smart Chain and Ethereum) to retrieve the current C2 address. Because updating the pointer is just a blockchain transaction costing fractions of a cent, operators can rotate infrastructure indefinitely, and because the ledger is immutable and has no single controlling entity, there is no registrar, hosting provider, or court order that can take it offline. The same immutability is a double-edged sword for the attackers: every pointer update is permanently and publicly visible on-chain, which lets investigators reconstruct operational history using free, public blockchain data.

The technique was first documented in October 2023 by Guardio Labs as a component of the financially motivated ClearFake campaign (tracked by Google as UNC5142), which embedded malicious JavaScript loader logic in BNB Smart Chain smart contracts behind fake browser-update overlays. In 2025, Google Threat Intelligence Group (GTIG) reported the first state-sponsored adoption: North Korean threat cluster UNC5342 (aka DeceptiveDevelopment/Famous Chollima/Void Dokkaebi), operating the "Contagious Interview" fake-recruiter social-engineering campaign, began embedding EtherHiding pointers in BNB Smart Chain and Ethereum smart contracts from around February 2025 to serve the BeaverTail/JADESNOW/InvisibleFerret malware chain to developers, updating the contract over 20 times in four months.

The campaign specifically documented in this record (GuidePoint Security, published 2026-09-01) is a distinct but related development: EtherHiding hosted on the Polygon blockchain, delivered through a "ClickFix" infection chain. Victims land on at least 31 compromised legitimate business websites (e-commerce, professional services, retail logistics) that display a fake "Verify you're human" CAPTCHA instructing them to paste and run a PowerShell command. Two obfuscation variants were observed: a string-replace obfuscation pattern (`$a="1i1e1x2i1r1m1" -replace 1 -split 2`) and direct invocation via `[System.Management.Automation.PowerShell]::Create()`. The resulting single-paste action silently installs a backdoor that persists across reboots via an `HKCU` Run-key value named `PersonalizedUpdates` and a scheduled task named `Enter` that beacons to C2 every 60 seconds; beacon traffic is XOR-obfuscated with the key `!sdf$&G321`, and victim machines are fingerprinted using the `MachineGuid` registry value. The backdoor resolves its current C2 domain by querying a Polygon smart contract through public RPC endpoints (publicnode, Tenderly, 1RPC, OnFinality, Subquery, dRPC, Lava) rather than a hardcoded address.

A second payload is a banking-trojan browser extension (Chromium extension ID `bpknfkhjjbjgagobdaekmnlgdhbbpcea`, observed under multiple cosmetic display names, communicating with a native messaging host `com.top.index`) that renders web-inject credential-capture panels sourced from attacker-controlled configuration servers to target banking and cryptocurrency platform logins.

Attacker-side infrastructure includes a build/staging server at `onemm[.]net` (origin IP `37.27.52.152`) that was itself compromised using a set of Linux/OpenSSH CISA KEV-listed vulnerabilities: CVE-2023-4911 (Looney Tunables glibc buffer overflow, local privilege escalation), CVE-2023-0386 (Linux kernel OverlayFS improper ownership management, local privilege escalation), CVE-2022-2586 (Linux kernel nf_tables use-after-free, local privilege escalation), CVE-2023-44487 (HTTP/2 Rapid Reset, denial of service), and CVE-2024-6387 (regreSSHion, OpenSSH signal-handler race condition enabling unauthenticated remote code execution). A network of traffic-distribution-system (TDS) domains (`additionalver[.]com`, `promo-chatgpt[.]com`, `pleasewaitcenter[.]top`, `skaybolt[.]online`, `lanhd6549tdhse[.]top`) and dedicated ClickFix delivery domains feed victims to the compromised sites and payload stages.

GuidePoint reports that several previously cleaned websites were silently re-compromised weeks later, indicating either an unpatched initial-access vector or renewed targeting, and that at least 31 organizations across e-commerce, professional services, and retail logistics have been affected as of publication. No single named threat-actor cluster is confirmed for this specific Polygon-based, ClickFix-delivered campaign; GuidePoint attributes it generically to criminal operators joined by North Korean state actors since late 2025 and Iran-linked groups since early 2026, distinct from (though thematically related to) UNC5342's separately documented BSC/Ethereum EtherHiding use in Contagious Interview.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1132.002 Non-Standard Encoding
- T1056.003 Web Portal Capture
- T1082 System Information Discovery
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1583.001 Domains
- T1584.004 Server

## Sources

- [EtherHiding Exposed: What Security Leaders Need to Know](https://www.guidepointsecurity.com/blog/etherhiding_exposed_what_security_leaders_need_to_know/)
- [North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts](https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html)
- [North Korean hackers use EtherHiding to hide malware on the blockchain](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/)
- [DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign](https://thehackernews.com/2023/10/binances-smart-chain-exploited-in-new.html)
- [EtherHiding - Hiding Web2 Malicious Code in Web3 Smart Contracts](https://medium.com/@guardiosecurity/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16)
- [ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims](https://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/)
- [Malicious Copy and Paste (T1204.004) - MITRE ATT&CK](https://gtkcyber.com/mitre/T1204.004/)
- [NVD - CVE-2023-4911 (Looney Tunables)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-4911)
- [NVD - CVE-2023-0386 (OverlayFS)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-0386)
- [NVD - CVE-2022-2586 (nf_tables UAF)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-2586)
- [NVD - CVE-2023-44487 (HTTP/2 Rapid Reset)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-44487)
- [NVD - CVE-2024-6387 (regreSSHion)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-6387)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2273