The inserted terminal command downloads additional malware via curl, including a backdoor written in Node.js that establishes itself permanently in the system via a LaunchAgent. To control the backdoor, the attackers use the EtherHiding method: the command and control server address is not hardcoded in the malware but is retrieved from an Ethereum smart contract as needed. The backdoor checks in with the command and control server every five minutes and executes any JavaScript code returned from there.
Through this channel, the attackers deploy two additional malicious programs: an information stealer that extracts browser data from Chrome, Brave, Edge, Firefox, Opera and Vivaldi, as well as access credentials from 157 different cryptocurrency wallets, SSH, AWS, Azure and npm accounts; and a malicious Chrome extension disguised as “Google Drive Offline,” which is injected through manipulation of the Chrome configuration file and is used to drain wallets.
AllSecure identified two Ethereum addresses embedded in the malware for resolving the command and control server. The associated smart contracts were each created by throwaway wallets following an identical four-step pattern: funding with approximately 0.0126 ether, contract deployment, configuration storage, forwarding of the remainder and wallet abandonment. Both the backdoor and the malicious browser extension are financed from the same wallet cluster, suggesting a single underlying actor. AllSecure CEO Christian Papathanasiou characterises the finding as follows: campaigns linked to North Korea have previously been described mainly in connection with fake job interviews; however, the current case demonstrates the same operational logic now also in the context of ordinary web searches, which expands the previous threat model.
Source: www.it-daily.net · Published 1 August 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.