“The experience is designed to induce panic,” AllSecure said
That description, lifted from an AllSecure report shared with The Hacker News, captures the core trick of a recently observed DPRK-linked macOS malvertising campaign: a full-screen fake macOS update sequence that quietly copies an attack command to the clipboard and then instructs the user to paste it into Terminal. The tactic — designed to make the machine appear frozen or rebooting — is part of a new iteration of the long-running Contagious Interview campaign (aka UNC5342).
ClickFix, EtherHiding and the Node.js backdoor
The attack chain begins with a technique known as ClickFix: a bogus system update screen that sets the victim up to paste a pre-copied command into Terminal. In the observed case the pasted command was a curl invocation that fetched a next-stage payload, which executed a Node.js backdoor. That backdoor uses a LaunchAgent to persist on the system and implements a novel, takedown-resistant C2 retrieval mechanism: it calls an Ethereum smart contract to resolve the live server address — a technique AllSecure describes as EtherHiding.
The implant is configured to check in with its command-and-control server every five minutes and to execute any JavaScript code returned by the server, giving the operator remote code-execution capability on infected hosts.
Delivery: malvertising via a sponsored search for electrophoresis machines
This iteration departs from earlier Contagious Interview lures such as fake job offers, video assessments, or coding tests. Instead the chain starts when a user clicks a search result. In the case documented by AllSecure, the victim was searching for electrophoresis machines and clicked a sponsored result for a company that appeared to sell them; the fake update sequence began immediately after the page loaded.
AllSecure noted that attempts to reproduce the sequence do not yield the same result, indicating the activation is intended to be single-use — a one-shot trigger tailored to induce urgent, unthinking compliance from the user.
Payloads: 157 cryptocurrency wallets, browser data and a malicious Chrome extension
Once the backdoor is in place, EtherHiding delivers two additional payloads. The first is an information stealer that harvests data from multiple web browsers — Chrome, Brave, Edge, Firefox, Opera, and Vivaldi — plus credentials and keys, including SSH, AWS, Azure, and npm keys. Crucially, it targets 157 cryptocurrency wallets.
The second payload is a malicious "Google Drive Offline" extension that is sideloaded into the browser by patching Chrome's Secure Preferences file. AllSecure reports the extension is used to drain a victim's wallet, making the operation a direct financial-exfiltration effort in addition to general data theft.
Ethereum contracts, throwaway wallets and an industrialised deployment pattern
AllSecure identified two embedded EtherHiding configuration addresses used to fetch C2 servers: "rg-telemetry[.]sbs/api" and "th-updates[.]sbs/analytics." Each corresponding smart contract was created by a throwaway wallet following an identical four-step script, according to the report: fund the wallet with roughly 0.0126 ETH, deploy the contract, write the configuration, forward the leftover ~0.006 ETH onward, and abandon the wallet.
That repeated pattern, AllSecure says, suggests an operator that has industrialised deployment: fund, deploy, configure, drain leftovers, abandon, repeat. Further analysis determined that both the backdoor and the browser-extension drainer were funded from the same wallet cluster, indicating the activity is the work of a single actor.
What this means for technologists, affected organisations, and end users
- Technologists and security teams: The combination of browser-based malvertising, a macOS UI deception that copies commands to the clipboard, and blockchain-hosted C2 means detections must span web traffic, endpoint behaviors (LaunchAgent persistence, Node.js processes), and unusual smart-contract interactions. The single-use activation and takedown-resistant EtherHiding elevate operational difficulty for defenders.
- Affected organisations and procurement teams: The observed delivery via a sponsored search result for specialised equipment (electrophoresis machines) underscores that targeted browsing for vendors or equipment can be an attack vector. Procurement and vendor-search workflows should consider the risk posed by compromised or spoofed sponsored listings.
- End users: The attack exploits panic and perceived system failure — a full-screen update that urges pasting a command into Terminal. AllSecure's assessment — that the experience is designed to induce panic — describes a social-engineering vector that can bypass ordinary caution if users believe the OS has failed.
Christian Papathanasiou, co-founder and CEO of AllSecure, framed the finding succinctly: "DPRK-linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario. That does not replace the fake-job pattern; it expands the threat model."
The observed campaign ties well-understood social-engineering techniques to two modern stabilisers for attackers — blockchain-based configuration and disposable financial infrastructure — and shifts the initial contact from job-hunting contexts into ordinary, everyday web searches. The combination of panic-inducing UI, single-use activation, and EtherHiding raises the bar for detection and takedown, and it argues for defenders to watch not just the inbox or recruitment portals but the full browsing surface and blockchain interactions used to resolve malicious infrastructures.
