The blockchain is not automatically infecting computers. Google Threat Intelligence reported that the North Korean-linked actor UNC5342 used a technique called EtherHiding in the Contagious Interview campaign: victims were lured into running code, which then retrieved additional malware from BNB Smart Chain and Ethereum data.
The campaign matters to cryptocurrency users, developers, job seekers, and businesses because the blockchain can make malicious payloads harder to remove. But it does not make the attack unstoppable. The initial lure, malware loader, API providers, websites, endpoints, and final command-and-control infrastructure can still be blocked or disrupted.
As an Amazon Associate I earn from qualifying purchases.
What happened
On October 16, 2025, Google Threat Intelligence said it had observed UNC5342, which it characterizes as a DPRK-linked threat actor, adopting EtherHiding in its ongoing Contagious Interview social-engineering campaign. Google described this as the first time it had observed a nation-state actor using the technique.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The operation reportedly used a JavaScript downloader called JADESNOW to retrieve a JavaScript version of INVISIBLEFERRET. Observed capabilities included credential theft, cryptocurrency-wallet theft, file theft, espionage, remote commands, and remote access. These are capabilities associated with the reported samples, not proof that every EtherHiding campaign uses the same malware.
#1 Best Overall
Google has tracked the relevant activity from February 2025. Attribution should be stated carefully: UNC5342 is Google’s identifier for this activity, and “North Korean-linked” or “DPRK-nexus” is more precise than treating UNC5342, Lazarus Group, APT38, and every other DPRK-related label as interchangeable.
Read Google’s technical report on the campaign.
What is EtherHiding?
EtherHiding is a malware-delivery and payload-retrieval technique. Attackers place malicious code, configuration data, or a resolver in blockchain transactions or smart-contract storage. A loader already running on a victim’s browser or computer queries the blockchain, decodes the returned data, and uses it to retrieve or execute the next stage.
- A victim receives a social-engineering lure, such as a fake job interview or coding test.
- The victim opens a repository, package, file, or command supplied by the attacker.
- JavaScript or another loader executes.
- The loader queries blockchain infrastructure or an API connected to it.
- The response contains encoded or obfuscated JavaScript, configuration, a downloader, or a command-and-control address.
- The loader decodes the response and fetches or executes the next-stage malware.
- The malware steals credentials, wallet data, files, or system information, and may accept remote commands.
A read-only blockchain call such as eth_call can retrieve contract data without creating a new transaction or requiring the victim to pay gas. That means a victim generally does not need to connect a wallet, sign a transaction, or approve a transfer for the retrieval stage to occur.
Free tools Windows power users keep installed
One-click scans. No signup required.
The reported UNC5342 infection chain
The reported chain can be summarized as:
Fake recruiter or technical interview
↓
Malicious coding test, repository, or package
↓
JADESNOW JavaScript downloader
↓
BNB Smart Chain smart-contract data
↓
Ethereum transaction data used as a dead drop
↓
INVISIBLEFERRET JavaScript backdoor
↓
Credential, wallet, file theft and remote commandsGoogle reported that JADESNOW could fetch or decrypt payloads from both BNB Smart Chain and Ethereum. The later-stage JavaScript backdoor could beacon system information, receive commands, execute commands, and exfiltrate files.
A related credential-stealing component was reported to target browser data from Chrome and Edge, passwords, session cookies, payment-card information, crypto-wallet extensions such as MetaMask and Phantom, and credentials associated with password managers including 1Password. Stolen data could be compressed and sent to attacker-controlled servers or a private Telegram chat.
What was stored on-chain?
The phrase “malware inside a smart contract” is a useful headline shorthand, but it is technically incomplete. Google observed multiple blockchain mechanisms:
- A BNB Smart Chain smart contract hosted JADESNOW-related payload material.
- Ethereum transaction data was used as another retrieval mechanism.
- Google said the malware read calldata from transactions sent to the well-known burn address
0x000000000000000000000000000000000000dEaD. The address functioned as part of a dead-drop system; it was not itself the infection mechanism. - Conventional websites, APIs, servers, and other infrastructure remained part of the broader operation.
Google identified this BNB Smart Chain contract associated with the activity:
0x8eac3198dd72f3e07108c4c7cff43108ad48a71c
It also identified an associated attacker-controlled address:
Rank #3
0x9bc1355344b54dedf3e44296916ed15653844509
Google reported that the contract was updated more than 20 times during its first four months, at an average cost of approximately $1.37 per update. One cited transaction contained Base64-encoded and XOR-encrypted data that decrypted to an obfuscated JavaScript payload assessed as JADESNOW.
Researchers can inspect public transaction history using BscScan and Etherscan, but public visibility is not a substitute for safe malware-analysis procedures.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhy attackers use blockchain infrastructure
EtherHiding gives attackers resilience rather than invisibility.
- Persistence: Data deployed to a public blockchain is difficult to remove through an ordinary hosting or domain takedown.
- Low-cost updates: Attackers can update contract-controlled data or publish new transaction data without replacing every lure or compromised webpage.
- Flexible routing: A loader can receive a new payload address, configuration, or command-and-control location.
- Public availability: Systems in different locations can query the same public blockchain infrastructure.
- Less obvious retrieval: Read-only calls do not create a victim-side blockchain transaction, reducing the need for a wallet and avoiding a visible gas payment.
- Analytical friction: Payloads can be distributed across contract storage, transaction calldata, several chains, explorer APIs, RPC services, and ordinary servers.
However, the blockchain is only one layer. Google reported that UNC5342 relied on centralized API providers to interact with otherwise permissionless chains. Those providers, along with domains, RPC endpoints, explorer APIs, compromised websites, endpoint processes, and final exfiltration servers, can provide monitoring and disruption opportunities.
How this differs from CLEARFAKE
EtherHiding was publicly described earlier in connection with the financially motivated CLEARFAKE campaign. The two campaign families should not be merged simply because they used similar blockchain techniques.
| CLEARFAKE / UNC5142 | UNC5342 / Contagious Interview | |
|---|---|---|
| Primary lure | Compromised websites and fake browser-update prompts | Fake recruiters, interviews, and technical assessments |
| Initial delivery | JavaScript injected into compromised WordPress sites | Victim-executed code, repositories, packages, or interview files |
| Blockchain use | BNB Smart Chain retrieval | BNB Smart Chain and Ethereum, including transaction-data dead drops |
| Reported payload focus | Malicious downloads, often presented as browser updates | JADESNOW, INVISIBLEFERRET-related components, credential theft, and espionage |
| Main human decision | Whether to accept a fake update | Whether to run code or commands supplied during a job process |
Guardio Labs’ earlier reporting context is summarized by BleepingComputer’s CLEARFAKE coverage.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does a smart contract automatically infect a computer?
No. A smart contract is not an executable program that automatically runs on every blockchain user’s laptop. In the reported operation, malicious JavaScript or another loader had to run first. That loader interpreted blockchain data and used it as a payload source, configuration channel, or dead-drop resolver.
Best Value
The practical infection point may therefore be a fake coding assignment, a malicious npm package, a compromised website, a deceptive “fix,” or a command pasted into Terminal, PowerShell, a browser developer console, or another interpreter.
Likewise, blockchain persistence does not mean the campaign is impossible to stop. Endpoint controls can block the loader, network controls can restrict API access, providers can respond to abuse reports, and defenders can monitor public contract and transaction indicators.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who is most exposed?
- Blockchain, Web3, exchange, and wallet employees.
- Developers downloading npm packages, GitHub repositories, or coding-test files.
- Job seekers applying for remote technical roles.
- People who keep browser wallet extensions, password managers, SSH keys, or cryptocurrency credentials on their everyday computer.
- Organizations operating WordPress sites or other public websites that could be compromised and used to inject JavaScript.
The key risk is not merely visiting a blockchain explorer. It is executing attacker-controlled code on a system that contains valuable credentials or wallet access.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What individuals and developers should do
- Verify the opportunity independently. Contact the employer using a phone number or website obtained separately from the recruiter’s message.
- Do not run interview code on a primary workstation. Use a disposable or isolated virtual machine with no production credentials, wallet extensions, SSH keys, or password-manager sessions.
- Treat repositories and packages as untrusted. Inspect dependencies and scripts before installing them, and do not assume GitHub, npm, or a professional-looking assignment is safe.
- Never paste unknown commands into a terminal or browser console. Prompts that ask you to disable security controls, install an unexpected tool, or paste a command are major warning signs.
- Minimize wallet exposure. Keep wallet extensions off machines used for untrusted testing when possible, and use hardware or isolated signing devices for significant funds.
- Rotate exposed secrets quickly. After suspected execution, change passwords from a clean device, revoke sessions and tokens, rotate API keys, and review wallet approvals.
- Protect funds if wallet data may have been exposed. Move assets to a clean wallet after assessing the risk to private keys or seed phrases.
- Preserve evidence. Keep original files, hashes, browser history, process logs, command lines, and network indicators rather than deleting everything immediately.
Enterprise controls that matter
- Use application allowlisting and restrict unauthorized script interpreters where practical.
- Block or restrict execution from downloads, temporary directories, npm project folders, and user-writable paths.
- Monitor browser child processes and unusual launches of PowerShell, Node.js, Python, or other scripting engines.
- Control browser extensions, especially cryptocurrency-wallet extensions, through enterprise policy.
- Restrict risky downloads and centrally manage browser updates. Google specifically cited file types such as
.EXE,.MSI,.BAT, and.DLLas examples for download restrictions. - Log DNS, proxy, TLS, process, and command-line activity.
- Investigate endpoints that unexpectedly contact public blockchain RPC services, explorer APIs, or related centralized providers.
- Alert on browser credential-store access, archive creation, and subsequent outbound transfer.
- Separate developer workstations from production signing systems, treasury wallets, and administrative credentials.
- For public websites, secure WordPress, plugins, administrator accounts, and unused accounts, and monitor for unauthorized JavaScript changes.
- Maintain an incident-response playbook covering both credential theft and cryptocurrency-wallet compromise.
Products can help, but no single product “blocks the blockchain.” Chrome Enterprise policies may help managed organizations control downloads, extensions, updates, and browser behavior. Cloudflare security services may help protect public websites against compromise and malicious script injection. Threat-intelligence and incident-response providers such as Google Cloud Security Operations and Mandiant are more relevant to larger organizations with dedicated security teams.
VirusTotal can assist with preliminary file and URL triage, but do not upload confidential source code, proprietary interview assignments, wallet data, or sensitive corporate files without understanding the service’s privacy and sharing implications. A clean scan also does not prove that a file is safe.
Bottom line
EtherHiding turns public blockchain data into a resilient malware-delivery or dead-drop layer. In the campaign reported by Google, UNC5342 combined fake technical interviews with JADESNOW, BNB Smart Chain, Ethereum transaction data, and INVISIBLEFERRET-related malware.
The most important defensive lesson is not to focus only on smart contracts. Preventing untrusted code execution, isolating developer and wallet environments, controlling browser behavior, monitoring script activity, and protecting credentials can stop or limit the attack even when the on-chain data remains publicly available.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
