North Korean EtherHiding Campaign Leverages Fake macOS Updates to Steal Crypto and Credentials
A North Korean cyber campaign, dubbed EtherHiding, is using deceptive macOS update screens to trick users into installing malware that targets cryptocurrency wallets and developer credentials, employing blockchain for command and control.
North Korean threat actors are employing a sophisticated campaign that uses fake macOS update screens to lure unsuspecting users into installing malware. This operation, identified by AllSecure analysts and linked to UNC5342 and Contagious Interview activity, expands beyond typical lures like fake job offers, targeting cryptocurrency wallets, browser data, and sensitive developer credentials.
The attack chain begins with a deceptive web page designed to mimic a frozen or rebooting Mac system, presenting a "ClickFix-style" lure. Victims are instructed to open their Terminal application and paste a command that the malicious page has already copied to their clipboard. Executing this command initiates the infection process, deploying a dropper that installs Node.js and an obfuscated remote access trojan (RAT).
A key innovation in the EtherHiding campaign is its command-and-control (C2) infrastructure. Instead of relying on traditional, easily identifiable servers, the malware queries Ethereum smart contracts to dynamically retrieve C2 details. This "EtherHiding" technique makes the operation more resilient and harder to disrupt, as attackers can update the underlying infrastructure without altering the malware installed on victim machines. Researchers observed two such Ethereum contracts embedded within the malware, which pointed to separate infrastructure for the backdoor and a malicious browser extension.
Once the RAT establishes a foothold, it deploys an infostealer. This module is designed to pilfer data from 157 different cryptocurrency wallets. Additionally, it collects saved browser passwords, cookies, history, bookmarks, SSH keys, cloud credentials, npm configuration files, and Foundry keystores, potentially exposing entire development environments to attackers.
Further compounding the threat, the campaign injects a malicious Chrome extension disguised as "Google Drive Offline." This extension requests extensive permissions, including browser debugging, cookie access, native messaging, and the ability to access all URLs. This allows attackers to persistently monitor or control browser activity, creating a significant risk for users.
The campaign's focus on developers is particularly concerning. Stolen cloud keys, source-control credentials, and browser sessions can provide attackers with a direct pathway into corporate infrastructure, echoing previous North Korean attacks that targeted developers and sensitive project data. The financial impact is also substantial, with AllSecure tracking approximately 464.80 ETH (roughly $890,000 USD) transferred to attacker-controlled wallets between late May and July 2026.
Organizations encountering this threat should treat any device where the command was executed as compromised. Immediate isolation, thorough examination for malicious LaunchAgents, altered .zshrc entries, suspicious Node.js processes, and unexpected Chrome extensions are crucial. All credentials should be reset from a clean device, and cryptocurrency assets should be moved to a secure, clean wallet. Legitimate macOS updates never require users to paste commands into Terminal, serving as a critical reminder for users to remain vigilant.