North Korean Hackers Deploy Blockchain Malware via EtherHiding

In early 2025, North Korean state-backed threat actors, specifically UNC5342, leveraged a new malware distribution technique called 'EtherHiding' to conduct advanced social engineering attacks against software and web developers. Utilizing smart contracts on public blockchains like Ethereum and Binance Smart Chain, the attackers embedded JavaScript payloads, allowing them to deliver and update malware with anonymity and resistance to takedowns. The lures involved fake job interviews that convinced victims to run malicious code, ultimately resulting in the in-memory deployment of the JADESNOW and InvisibleFerret malware for credential theft, financial data exfiltration, and ongoing espionage.

This breach is particularly significant as it marks the first known nation-state operation using EtherHiding to evade detection and persistently update attack tools on-chain. The campaign signals a macro shift to blockchain-based malware delivery, complicating threat intelligence, response, and regulatory postures in the face of evolving infostealer and espionage techniques.

Blockchain-based malware distribution presents new evasion challenges, as payloads stored via smart contracts are exceptionally difficult to disrupt. As threat actors adopt these decentralized techniques, organizations must adapt security controls to monitor interactions with blockchain infrastructure and protect against social engineering that targets technical professionals.