EtherHiding: the malware host nobody can take down.
Attackers no longer need a server for their next stage. They store it in a smart contract on a public blockchain, and a hacked website reads it from there on every visit. No domain to seize, no hosting provider to call.
In short
- A small script injected into a compromised site (often WordPress) calls a public blockchain node and reads data from a contract.
- The data is the next stage: usually a fake update or a fake CAPTCHA that leads to ClickFix.
- Reading a contract is free and leaves no transaction; the attacker can change the payload whenever they like.
- Blocking servers does not work. Spotting the contract call and the lure in the browser does.
How EtherHiding works
- A legitimate website is compromised and gets a few lines of JavaScript in its pages.
- The script calls a blockchain node (for example on BNB Smart Chain or Polygon) with a read-only request (
eth_call) to a contract the attacker controls. - The contract returns code or an address, often encoded, which the script decodes and runs or loads.
- The visitor sees the lure: “update your browser”, “verify you are human”. From there, the user is guided to paste a command or download a file.
Security researchers at Google have described financially motivated groups and a state-backed group using this technique to distribute information stealers and backdoors, and other researchers report contracts used directly for command and control.
Why it is so hard to stop
- No takedown. A smart contract cannot be deleted by a registrar or a hosting company.
- Instant updates. The attacker changes the stored payload with one transaction; every compromised site serves the new version at once.
- Legitimate infrastructure. The requests go to public blockchain nodes that many real applications use, so blocking them by name breaks real sites.
- The site owner may not notice. The injected script is small, and the lure is often shown only to some visitors.
What helps
- For website owners: keep WordPress core, themes and plugins updated, remove unused plugins, protect admin accounts with MFA and check pages for unknown scripts that call blockchain nodes.
- For organisations: stop the step that turns a visit into an infection — the clipboard command or the fake download — and see which of the sites your people use are compromised.
How ByteMantle helps
- The contract call is recognised. ByteMantle sees the blockchain requests a page makes. A page with no wallet activity that reads a contract is suspicious; if the answer contains a web address, it is flagged as high severity. Legitimate dApps keep working: contract reads are not blocked automatically.
- The lure is stopped. The fake update or fake CAPTCHA that follows is detected, a command written to the clipboard is replaced with a harmless message, and the contract read plus the lure become one critical incident: ClickFix via EtherHiding.
- You learn which site is compromised. The console shows the site, the script that loaded the attack and the contract, so you can warn the site owner and block it for your browsers.
More on EtherHiding detection, and a real case in our research on the SC WordPress backdoor.
Questions people ask
Is EtherHiding a crypto scam?
No. Victims do not need a wallet or any crypto. The blockchain is only used as a hosting place for malicious code that ordinary websites load.
Which websites are affected?
Mostly legitimate sites that were hacked, very often WordPress sites with outdated plugins or weak admin passwords.
Can I block blockchain domains on my network?
You can block known public node addresses, but campaigns switch between providers and many legitimate sites use them. Detecting the specific contract call and the lure is more reliable.
Stop these attacks before anything runs.
Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it.