North Korean group hosts recruitment malware via blockchain contracts

North Korean-linked threat actors have begun embedding malware in public blockchain smart contracts to support ongoing recruitment scams that have stolen credentials and cryptocurrency, researchers said. Since February, analysts have observed a group tracked as UNC5342 using a technique known as EtherHiding to host JavaScript payloads on Ethereum and Binance Smart Chain as part of fake job interview campaigns targeting software, web and cryptocurrency developers.

Security researchers described EtherHiding as a method that places malicious code inside smart contracts, allowing attackers to fetch payloads via read-only calls that leave little on-chain transaction history. Google’s Threat Intelligence Group said the technique lets operators maintain a decentralized command and control mechanism that is resistant to takedown and inexpensive to update. Researchers noted the smart contracts supporting these campaigns were updated more than 20 times in the first four months at an average gas cost of about 1.37 U.S. dollars per update, illustrating how quickly operators can alter campaign configurations.

The social engineering pattern observed across multiple incidents begins with...