header banner

EtherHiding: Cybercriminals develop a cutting-edge technique to conceal harmful code in blockchains

Table of Contents

    Threat actors have worked out a way to hide malicious payloads in Binance smart contracts to lure victims into updating their browsers from fake prompts, according to cybersecurity researchers.

    38221 Total views

    123 Total shares

    EtherHiding: Hackers create novel way to hide malicious code in blockchains

    Cybercriminals have discovered a new way to spread malware to unsuspecting users, this time by manipulating BNB Smart Chain (BSC) smart contracts to hide malware and disseminate malicious code.

    A breakdown of the technique known as “EtherHiding” was shared by security researchers at Guardio Labs in an Oct. 15 report, explaining that the attack involves compromising WordPress websites by injecting code that retrieves partial payloads from the blockchain contracts.

    The attackers hide the payloads in BSC smart contracts, essentially serving as anonymous free hosting platforms for them.

    Guardio Labs exposes "EtherHiding" - a new threat hiding in Binance's Smart Chain, a technique that evades detection, targeting compromised WordPress sites. Read about this game-changing method! @BNBCHAIN #BNBChain #CyberSecurity https://t.co/alNI5KqKUO

    — Guardio (@GuardioSecurity) October 15, 2023

    The hackers can update the code and change the attack methods at will. The most recent attacks have come in the form of fake browser updates, where victims are prompted to update their browsers using a fake landing page and link.

    The payload contains JavaScript that fetches additional code from the attacker’s domains. This eventually leads to full site defacement with fake browser update notices that distribute malware.

    This approach allows the threat actors to modify the attack chain by simply swapping out malicious code with each new blockchain transaction. This makes it challenging to mitigate, according to Nati Tal, head of cybersecurity at Guardio Labs, and fellow security researcher Oleg Zaytsev.

    Once the infected smart contracts are deployed, they operate autonomously. All Binance can do is rely on its developer community to flag malicious code in contracts upon discovery.

    Contract address flagged for scam activity. Source: Guard.io

    Guardio stated that website owners using WordPress, which runs roughly 43% of all websites, need to be extra vigilant with their own security practices before adding:

    “WordPress sites are so vulnerable and frequently compromised, as they serve as primary gateways for these threats to reach a vast pool of victims.”

    Related: Crypto investors under attack by new malware, reveals Cisco Talos

    The firm concluded that Web3 and blockchain bring new possibilities for malicious campaigns to operate unchecked. “Adaptive defenses are needed to counter these emerging threats,” it said.

    Collect this article as an NFT to preserve this moment in history and show your support for independent journalism in the crypto space.

    Magazine: Blockchain detectives — Mt. Gox collapse saw birth of Chainalysis


    Article information

    Author: Lawrence Cohen

    Last Updated: 1700084282

    Views: 1203

    Rating: 4.3 / 5 (100 voted)

    Reviews: 99% of readers found this page helpful

    Author information

    Name: Lawrence Cohen

    Birthday: 1973-11-18

    Address: Unit 7891 Box 7173, DPO AE 44413

    Phone: +3836613351477914

    Job: Journalist

    Hobby: Painting, Reading, Raspberry Pi, Animation, Scuba Diving, Survival Skills, Skiing

    Introduction: My name is Lawrence Cohen, I am a courageous, rich, talented, vivid, risk-taking, vibrant, unswerving person who loves writing and wants to share my knowledge and understanding with you.