Attackers are reviving the abuse of the Node.js runtime to execute malicious JavaScript payloads and evade signature-based detection. In multiple intrusions since February 2026, threat actors including initial access broker Woodgnat have used Node.js implants for persistence via registry Run keys and command-and-control via Ethereum blockchain smart contracts (EtherHiding). The technique has been observed alongside tools like ModeloRAT, C2Looper, and Backdoor.Mistic in attacks targeting government, technology, and financial sectors.
EtherHiding
9 posts
Node.js: Old Technique Makes a Comeback Intelligence Insights: August 2026 Red Canary's July 2026 threat intelligence highlights ClearFake maintaining its top position and the debut of four new threats: GraphSpy, Phexia, CastleRAT, and EtherRAT. A notable trend is the increasing use of dead drop resolution and EtherHiding, where malware queries public blockchain smart contracts or abused legitimate platforms like Steam and Telegram to dynamically resolve C2 URLs. This technique complicates static analysis and indicator-based blocking.
ChainDrop NPM Worm Analysis | ThreatLabz ChainDrop is a self-propagating NPM worm that entered the npm ecosystem on August 4, 2026 through a compromised maintainer account of the keyv ecosystem. The attacker pushed malicious commits to source repositories, causing trusted GitHub Actions release pipelines to build and publish poisoned packages with valid SLSA Build Level 3 provenance. The worm spread to over 400 packages by stealing npm tokens and republishing infected versions, using Bun runtime to evade Node.js-focused security tools and anchoring C2 infrastructure in an Ethereum smart contract for resilient domain rotation.
ACR Stealer: Two observed intrusion chains amid increased threat activity Microsoft Defender Experts identified two prevalent ClickFix-based intrusion chains delivering ACR Stealer, a MaaS information stealer rebranded from Amatera Stealer. Campaign 1 leverages rundll32-driven WebDAV DLL loading, obfuscated PowerShell, Python loaders, scheduled-task persistence, and Fiber-API in-memory shellcode execution, with a subset using blockchain RPC endpoints (EtherHiding) as dead-drop C2 resolvers. Campaign 2 achieves near-fully fileless execution via MSHTA/COM-launched PowerShell that retrieves a payload hidden in JPEG steganography and executes it reflectively in memory, with both chains ultimately harvesting browser credentials, DPAPI secrets, and sensitive documents for exfiltration.
ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites A large-scale ClickFix campaign compromises hundreds of WordPress websites to deliver a macOS infostealer via fake Cloudflare CAPTCHA overlays. The campaign uses a Polygon blockchain smart contract to store the C2 URL, making it resistant to DNS takedowns. Victims are tricked into pasting a Terminal command that downloads an in-memory payload via curl, which uses osascript to harvest Keychain data, browser credentials, SSH keys, and screenshots before exfiltrating them in chunks to an attacker-controlled server.
Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor A multi-stage attack campaign uses malicious LNK files delivered via booking-themed phishing emails to deploy a Node.js-based backdoor. The LNK files use bigint arithmetic obfuscation to reconstruct C2 URLs, download a PowerShell payload that deploys a legitimate node.exe binary, and execute an AES-128-CBC encrypted JavaScript backdoor. The backdoor retrieves its C2 address from the TON blockchain using the EtherHiding technique, employs a custom bytecode VM interpreter for defense evasion, and supports downloading and executing additional payloads including PE files, PowerShell, and JavaScript.
US Threat Landscape Alert: 30 Active Malware Families Ranked by Real Sandbox Data ANY.RUN's Malware Trends Tracker data shows that phishing-as-a-service kits now dominate the US threat landscape, with five of the top ten threats being AiTM or device-code phishing platforms that defeat MFA by stealing session cookies or OAuth tokens. Commodity RATs and info stealers remain in constant high-volume circulation, while legacy threats like Emotet and WannaCry persist on unpatched systems. Several top-ranked threats (Cobalt Strike, Qbot, Emotet, DonutLoader, Smoke Loader) function as ransomware precursors, meaning their detection should trigger urgent escalation rather than routine handling.
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework ErrTraffic is a Malware-as-a-Service framework that compromises WordPress sites and uses malvertising to deliver ClickFix social engineering lures. It leverages EtherHiding via Polygon smart contracts to dynamically resolve C2 infrastructure and distribute infostealers, RATs, and loaders.
Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet Threat actors behind the ClearFake campaign are leveraging EtherHiding to host malicious JavaScript payloads within BNB Smart Chain testnet smart contracts, bypassing traditional URL-based blocking. The attack chain begins with a compromised watering hole site and uses a ClickFix social engineering overlay to trick Windows and macOS users into executing malicious commands. This leads to the deployment of SectopRAT and ACRStealer via WebDAV DLL loading and DLL sideloading, enabling extensive credential and browser session theft.
