XRP, other crypto assets targeted in EtherHiding attack

North Korean threat actors have adopted a blockchain-based technique called EtherHiding to deliver malware designed to steal cryptocurrency including XRP.

According to Google’s Threat Intelligence Group , this is the first time GTIG has observed a nation-state actor using this method.

The method embeds malicious JavaScript payloads inside blockchain smart contracts to create resilient command-and-control servers.

The EtherHiding technique targets developers in cryptocurrency and technology sectors through social engineering campaigns tracked as “Contagious Interview.”

The campaign has led to numerous cryptocurrency heists affecting XRP ( XRP ) holders and users of other digital assets.

Blockchain-based attack infrastructure evades detection

EtherHiding stores malicious code on decentralized and permissionless blockchains and removes central servers that law enforcement or cybersecurity firms can take down.

Attackers controlling smart contracts can update malicious payloads at any time and maintain persistent access to compromised systems.

Security researchers can tag contracts as malicious on blockchain scanners like BscScan, but malicious activity continues regardless of these warnings.

Google’s report describes EtherHiding as a “shift towards next-generation bulletproof hosting” where blockchain technology features enable malicious purposes.

When users interact with compromised sites, the code activates to steal XRP, other cryptocurrencies, and sensitive data.

The compromised websites communicate with blockchain networks using read-only functions that avoid creating ledger transactions. This minimizes detection and transaction fees.

Sophisticated social engineering

The Contagious Interview campaign centers on social engineering tactics that mimicks legitimate recruitment processes through fake recruiters and fabricated companies.

Fake recruiters lure candidates onto platforms like Telegram or Discord, then deliver malware through deceptive coding tests or fake software downloads disguised as technical assessments.

The campaign employs multi-stage malware infection, including JADESNOW, BEAVERTAIL, and INVISIBLEFERRET variants affecting Windows, macOS, and Linux systems.

Victims believe they’re participating in legitimate job interviews while unknowingly downloading malware designed to gain persistent access to corporate networks and steal cryptocurrency holdings.