Loading story…
Researchers identified a new blockchain-based command-and-control resolution technique dubbed NullReceiver in two trojanized npm packages, bianira-ui@1.27.0 and fluid-type-ui@2.0.8, tied to the DPRK-linked Contagious Interview campaign. The packages use a hardcoded Ethereum wallet, 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, and recover their next-stage infrastructure by querying the wallet’s latest zero-value, zero-data Ethereum transaction rather than relying on embedded domains or traditional blockchain-stored payloads.
Analysis showed the malware decodes the command-and-control IP directly from the recipient address of that blank transaction, yielding 166.88.134.62, with ports 443 and 80 identified as associated infrastructure. Researchers said the approach improves on EtherHiding by avoiding smart contracts, calldata, and fixed public sink addresses, making the C2 lookup harder to spot while leaving only minimal on-chain artifacts; the findings were derived from static analysis of the published npm tarballs and review of public blockchain activity without executing the packages.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
On August 10, 2026, Sonatype Research Labs identified six npm packages carrying the same malicious loader that uses Ethereum transactions as a dead-drop to recover command-and-control infrastructure. The set included three hijacked legitimate packages and three malicious packages published to distribute the malware, and Sonatype linked the activity to the DPRK-linked Contagious Interview campaign through a shared Ethereum wallet address.
OpenSourceMalware reported identifying a new blockchain-based C2 resolution technique called NullReceiver in the trojanized npm packages bianira-ui@1.27.0 and fluid-type-ui@2.0.8, attributing the activity to the DPRK-linked Contagious Interview campaign. Their analysis recovered infrastructure including 166.88.134.62 on ports 443 and 80 from the attacker’s Ethereum transaction pattern.
The OpenSourceMalware article states that Google Threat Intelligence linked the EtherHiding blockchain-based command-and-control technique to a DPRK-linked actor in October 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
10 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcemalware.news
Open sourcesonatype.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcebsky.app
Open sourceopensourcemalware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two likely DPRK-linked malware operations that used public blockchains as resilient command-and-control infrastructure while targeting the cryptocurrency ecosystem and software developers. Elastic Security Labs said the **PHANTOMPULSE** Windows RAT, delivered through abused Obsidian plugins and the `PHANTOMPULL` loader, used multiple process-injection techniques, a `schuac`-based UAC bypass via `IElevatedFactoryServer`, hardware breakpoints to suppress **AMSI**, **WLDP**, and **ETW**, and scheduled tasks for persistence. The implant conducted host reconnaissance, screenshot capture, keylogging, and clipboard monitoring, and resolved its latest C2 by reading transaction data from **Ethereum**, **Base**, and **Optimism**, with Telegram and hardcoded-domain fallback paths also noted. A separate supply-chain intrusion attributed to **Famous Chollima** compromised the legitimate Packagist package `roberts/leads`, hiding malicious JavaScript in a development-branch `tailwind.js` file that fetched encrypted payloads from **TRON**, **Aptos**, and **BNB Smart Chain**. Socket linked the activity to prior DPRK tooling including **DEV#POPPER RAT**, **OmniStealer**, and **BeaverTail**, while public reporting and social-media tracking tied it to the broader **Contagious Interview** ecosystem. Elastic said PHANTOMPULSE's blockchain resolver failed to verify transaction senders, creating a rare opportunity for defenders to sinkhole infected hosts with a crafted transaction, and advised monitoring suspicious scheduled tasks, unusual `rundll32.exe` execution, hardware-breakpoint tampering, and Node.js access to blockchain or RPC services during builds.
Jun 29, 2026
Researchers from Ransom-ISAC, Bridewell, and Crystal Intelligence detailed a malware campaign that used a weaponized private GitHub repository and Telegram-based fake job lures to target developers, delivering a multi-stage infection chain built around **Cross-Chain TxDataHiding**. In the observed September 2025 intrusion, a trojanized `node-react-e-commerce` project hid encrypted JavaScript payloads and command data in blockchain transactions, using TRON or Aptos records as pointers to Binance Smart Chain data and later expanding across Ethereum, Aurora, and other chains. The malware chain included the JavaScript RAT **DEV#POPPER.js** and the Python stealer **OmniStealer**, enabling cross-platform execution on Windows, macOS, and Linux, persistence through VSCode and Cursor IDE modification, and theft of credentials, browser artifacts, wallet data, environment variables, and developer secrets. Investigators said the campaign paired blockchain-hosted payload delivery with conventional HTTP and `socket.io` command-and-control infrastructure, including clusters tied to Evoxt, Clouvider, PJSC Megafon, and a Russia-linked RDP setup, while some infrastructure also overlapped with IPs previously reported in 2025 NPM supply-chain compromises. A later financial-forensics investigation attributed the broader blockchain malware infrastructure to **North Korean threat actors** by tracing operational wallets through bridges, swap services, and laundering hubs including **Huione**, **Xinbi Guarantee**, and **BlackU**, and by linking funding flows to wallets associated with documented DPRK cryptocurrency thefts, including the **Bybit** theft. Researchers also cited weekday working-hour patterns, rotating C2 servers, and one wallet access event from IP `188.43.33.249` in Vladivostok consistent with known DPRK routing, concluding that the attackers built a hard-to-disrupt on-chain malware and C2 ecosystem designed for stealth, resilience, and cryptocurrency theft.
Aug 14, 2026
Google Cloud's Mandiant reported that North Korean operators adopted **EtherHiding**, a technique that abuses blockchain infrastructure to hide malicious content and stage malware delivery. The activity uses decentralized platforms to store or retrieve attacker-controlled data, complicating takedown efforts and making network-based detection harder because the infrastructure blends into legitimate blockchain traffic. The report links the tradecraft to DPRK threat activity and highlights a broader shift toward resilient, hard-to-disrupt hosting for command-and-control or payload staging. By moving parts of the infection chain onto blockchain-backed services, the operators reduce reliance on traditional attacker domains and hosting, increasing the durability and stealth of malware campaigns targeting victims across the internet.
Jun 29, 2026