Loading story…
Researchers from Ransom-ISAC, Bridewell, and Crystal Intelligence detailed a malware campaign that used a weaponized private GitHub repository and Telegram-based fake job lures to target developers, delivering a multi-stage infection chain built around Cross-Chain TxDataHiding. In the observed September 2025 intrusion, a trojanized node-react-e-commerce project hid encrypted JavaScript payloads and command data in blockchain transactions, using TRON or Aptos records as pointers to Binance Smart Chain data and later expanding across Ethereum, Aurora, and other chains. The malware chain included the JavaScript RAT DEV#POPPER.js and the Python stealer OmniStealer, enabling cross-platform execution on Windows, macOS, and Linux, persistence through VSCode and Cursor IDE modification, and theft of credentials, browser artifacts, wallet data, environment variables, and developer secrets.
Investigators said the campaign paired blockchain-hosted payload delivery with conventional HTTP and socket.io command-and-control infrastructure, including clusters tied to Evoxt, Clouvider, PJSC Megafon, and a Russia-linked RDP setup, while some infrastructure also overlapped with IPs previously reported in 2025 NPM supply-chain compromises. A later financial-forensics investigation attributed the broader blockchain malware infrastructure to North Korean threat actors by tracing operational wallets through bridges, swap services, and laundering hubs including Huione, Xinbi Guarantee, and BlackU, and by linking funding flows to wallets associated with documented DPRK cryptocurrency thefts, including the Bybit theft. Researchers also cited weekday working-hour patterns, rotating C2 servers, and one wallet access event from IP 188.43.33.249 in Vladivostok consistent with known DPRK routing, concluding that the attackers built a hard-to-disrupt on-chain malware and C2 ecosystem designed for stealth, resilience, and cryptocurrency theft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Crystal Intelligence reported that the Cross-Chain TxDataHiding malware operations continued through November 2025. Throughout this period, operators rotated command-and-control servers while maintaining blockchain-based infrastructure.
Ransom-ISAC and Bridewell analyzed the September 2025 campaign infrastructure and expanded the original four C2 IPs into multiple HTTP API, socket.io, RDP, and HTTP 302 redirection clusters. The work linked high-confidence infrastructure to Evoxt-hosted servers and identified additional lower-confidence clusters across other providers.
The September 2025 intrusion chain delivered a cross-platform Node.js RAT dubbed DEV#POPPER.js and a Python information stealer named OmniStealer. The malware provided remote code execution, persistence in VS Code and Cursor files, and theft of wallets, credentials, browser data, source code, and developer secrets.
Ransom-ISAC documented a novel malware delivery method it named Cross-Chain TxDataHiding, in which TRON or Aptos transactions pointed to encrypted payloads stored in Binance Smart Chain transaction input data. The technique used blockchain data as a resilient command-and-control and payload retrieval layer.
In September 2025, attackers used a fake blockchain-related job approach over LinkedIn and Telegram to lure a developer into a private GitHub repository named store-v impersonating node-react-e-commerce. The repository contained the initial malicious JavaScript stager in Tailwind.config.js.
Crystal Intelligence and Ransom-ISAC reported that the blockchain-hosted malware operations began in early June 2025. From that point, operators used rotating command-and-control servers and blockchain transaction data to support the campaign.
The infrastructure analysis found that several identified IP addresses overlapped with Aikido reporting on 2025 NPM supply-chain compromises. The overlap supported the assessment that the intrusion was likely related to that broader campaign.
The financial tracing showed funds moving through legitimate services, bridges, swaps, and layered transactions between October 2024 and April 2025. Investigators said these flows appeared normal in isolation but formed part of the operational funding chain for the malware infrastructure.
Investigators found some infrastructure wallets had been funded and then remained dormant since 2021 before later being activated for malware operations. The report cites this as evidence of multi-year operational planning behind the campaign.
The blockchain analysis also found medical records, chest X-rays, legal documents, and audio files embedded in transactions unrelated to direct malware delivery. The report interpreted these artifacts as systematic testing of blockchain-based operational tradecraft and file-handling methods.
Crystal Intelligence and Ransom-ISAC attributed the Cross-Chain TxDataHiding infrastructure campaign to North Korean threat actors by tracing operational wallet funding backward through bridges, swaps, and layered transactions. The investigation linked campaign wallets to documented DPRK theft activity, including the Bybit theft, and to laundering hubs such as Huione, Xinbi Guarantee, and BlackU.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
crystalintelligence.com
Open sourceransom-isac.org
Open sourceransom-isac.org
Open sourceransom-isac.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two likely DPRK-linked malware operations that used public blockchains as resilient command-and-control infrastructure while targeting the cryptocurrency ecosystem and software developers. Elastic Security Labs said the **PHANTOMPULSE** Windows RAT, delivered through abused Obsidian plugins and the `PHANTOMPULL` loader, used multiple process-injection techniques, a `schuac`-based UAC bypass via `IElevatedFactoryServer`, hardware breakpoints to suppress **AMSI**, **WLDP**, and **ETW**, and scheduled tasks for persistence. The implant conducted host reconnaissance, screenshot capture, keylogging, and clipboard monitoring, and resolved its latest C2 by reading transaction data from **Ethereum**, **Base**, and **Optimism**, with Telegram and hardcoded-domain fallback paths also noted. A separate supply-chain intrusion attributed to **Famous Chollima** compromised the legitimate Packagist package `roberts/leads`, hiding malicious JavaScript in a development-branch `tailwind.js` file that fetched encrypted payloads from **TRON**, **Aptos**, and **BNB Smart Chain**. Socket linked the activity to prior DPRK tooling including **DEV#POPPER RAT**, **OmniStealer**, and **BeaverTail**, while public reporting and social-media tracking tied it to the broader **Contagious Interview** ecosystem. Elastic said PHANTOMPULSE's blockchain resolver failed to verify transaction senders, creating a rare opportunity for defenders to sinkhole infected hosts with a crafted transaction, and advised monitoring suspicious scheduled tasks, unusual `rundll32.exe` execution, hardware-breakpoint tampering, and Node.js access to blockchain or RPC services during builds.
Jun 29, 2026
North Korean state-sponsored hackers have adopted a novel technique known as EtherHiding to distribute malware and facilitate cryptocurrency theft. The Google Threat Intelligence Group (GTIG) has attributed this activity to a threat actor tracked as UNC5342, which is also known by several other names including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, and Void Dokkaebi. This marks the first documented instance of a state-backed hacking group leveraging EtherHiding, a method previously described by Guardio Labs in 2023. EtherHiding involves embedding malicious payloads within smart contracts on public blockchains such as Ethereum and Binance Smart Chain (BSC), allowing attackers to host and update malware in a manner that is highly resistant to takedown and difficult to trace. The campaign, codenamed Contagious Interview, targets software and web developers through social engineering, often beginning with fake job offers on LinkedIn. Attackers impersonate recruiters or hiring managers from fabricated entities like BlockNovas LLC, Angeloper Agency, and SoftGlide LLC, and eventually move conversations to platforms like Telegram or Discord. Victims are tricked into running code as part of a technical assessment, which executes a JavaScript downloader. This downloader, known as JADESNOW, interacts with the blockchain to fetch a third-stage payload, typically a JavaScript version of the InvisibleFerret malware, which is designed for long-term espionage. The payload runs in memory and may request additional components from the blockchain, such as credential stealers. The use of smart contracts for payload delivery provides anonymity, flexibility for updating malicious code, and evasion of traditional detection and takedown mechanisms. The attackers' ability to retrieve payloads from either Ethereum or BSC further complicates analysis and defense. The campaign's objectives align with North Korea's dual goals of cyber espionage and financial gain, as the malware is used to steal sensitive data and siphon cryptocurrency assets from compromised developers. The cost to update the malicious payload is minimal, averaging around $1.37 in gas fees, making the technique both economical and scalable for the threat actors. The use of read-only calls to fetch payloads leaves no visible transaction history, enhancing the stealth of the operation. This development represents a significant evolution in the tactics of North Korean cyber operations, demonstrating their increasing sophistication and willingness to exploit decentralized technologies for malicious purposes. Security researchers warn that the resilience and anonymity provided by blockchain-based malware delivery could inspire similar tactics among other threat actors. Organizations are advised to increase vigilance, especially when dealing with unsolicited job offers and technical assessments that require code execution. The campaign underscores the importance of robust security awareness training and technical controls to detect and prevent such advanced social engineering and malware delivery techniques.
Jun 29, 2026
Google Cloud's Mandiant reported that North Korean operators adopted **EtherHiding**, a technique that abuses blockchain infrastructure to hide malicious content and stage malware delivery. The activity uses decentralized platforms to store or retrieve attacker-controlled data, complicating takedown efforts and making network-based detection harder because the infrastructure blends into legitimate blockchain traffic. The report links the tradecraft to DPRK threat activity and highlights a broader shift toward resilient, hard-to-disrupt hosting for command-and-control or payload staging. By moving parts of the infection chain onto blockchain-backed services, the operators reduce reliance on traditional attacker domains and hosting, increasing the durability and stealth of malware campaigns targeting victims across the internet.
Jun 29, 2026