macOS ClickFix EtherHiding: DPRK Backdoor Hides C2 in Ethereum Smart Contracts
A routine internet search can culminate in a full macOS compromise – one in which a counterfeit system update prompt manipulates the user into executing a malicious command themselves, and the implanted backdoor retrieves its command-and-control address not from a hardcoded server, but from an Ethereum smart contract.
How the Attack Begins
As detailed by AllSecure researchers in their ClickFix-EtherHiding-DPRK analysis, the infection chain opens with a malicious advertisement or a page injected into a compromised website.
The browser is forced into full-screen mode, presenting a convincing simulation of a macOS reboot sequence that strips away normal navigation controls. The page then announces a critical system update and instructs the visitor to open Terminal, paste a command already silently copied to their clipboard, and press Enter.
Crucially, no infection occurs unless the user follows these instructions. The victim is the mechanism.
The ClickFix Technique Explained
This social engineering approach – known as ClickFix – exploits the implicit trust users place in system-level prompts. By mimicking a legitimate operating system interface and removing escape routes through full-screen lockout, attackers dramatically increase the likelihood of compliance.
The technique is especially effective against users unfamiliar with Terminal, who may regard the prompt as a routine maintenance step rather than a security breach in progress.
The Node.js Backdoor and Its Persistence Mechanisms
Once executed, the command downloads a heavily obfuscated backdoor written in Node.js. The implant establishes persistence through multiple overlapping methods.
Persistence Layers
The backdoor registers itself as a LaunchAgent, ensuring it relaunches automatically on login. It also appends an entry to the ~/.zshrc file and deposits copies of itself within the system cache directory. Together, these three persistence mechanisms make casual removal unreliable.
Remote Code Execution via JavaScript
Approximately every five minutes, the backdoor contacts its command-and-control server and executes whatever JavaScript payload it receives via eval. This architecture grants operators full remote control over the compromised Mac without requiring any additional binary deployment.
EtherHiding: C2 Infrastructure Concealed in the Blockchain
The command-and-control server address is never stored within the malware itself. Instead, the backdoor queries two Ethereum smart contracts through publicly accessible network nodes to retrieve its current configuration.
This technique – known as EtherHiding – effectively decouples the malware from its infrastructure. The contracts do not issue commands directly. They simply point the backdoor toward wherever the operators currently want it to connect.
Why This Makes Takedowns Exceptionally Difficult
Updating the infrastructure requires nothing more than writing a new address to the blockchain. The backdoor itself never needs to be redeployed or updated. Traditional threat intelligence approaches – blocking hardcoded IPs or domains – are therefore largely ineffective against this architecture.
Data Theft: What the Infostealer Targets
The backdoor’s secondary payload is a comprehensive infostealer. It conducts a systematic search for files associated with 157 distinct cryptocurrency wallet applications, alongside saved browser passwords, session cookies, browsing history, SSH keys, and stored credentials for cloud services.
A Hidden Chrome Extension
Additionally, the malware covertly installs a rogue Chrome extension presenting itself as “Google Drive Offline.” This extension is granted access to all websites, cookies, and browser debugging interfaces – providing attackers with a persistent, browser-level surveillance channel even if the primary backdoor is later removed.
Attribution: Links to DPRK Group UNC5342
AllSecure’s researchers attributed the attack technique to UNC5342, a North Korean threat actor associated with the Contagious Interview campaign. Several indicators converge on this attribution.
The ClickFix lure methodology, the deliberate targeting of cryptocurrency assets and credentials, the use of eval-based JavaScript execution, and blockchain-anchored command-and-control infrastructure all align with previously documented UNC5342 tradecraft.
However, analysis of two distinct funding chains did not conclusively confirm that a single operator controlled both components of the infrastructure simultaneously.
Following the Money
The wallets that deployed the Ethereum smart contracts received funds routed through KuCoin and Binance. One associated funding chain absorbed 464.8 ETH – equivalent to approximately $890,000 – across 281 separate transactions.
The smart contracts themselves maintained a zero balance throughout. Their sole function was configuration storage: a deliberately minimalist design that leaves almost no forensic footprint on-chain.
How to Respond If You Executed the Command
Users should close any tab that instructs them to paste a command into Terminal. No legitimate software update or system maintenance procedure ever requires this step.
If the command was already executed, the affected Mac should be isolated from all networks immediately. The following remediation steps are recommended: remove the LaunchAgent entry and all associated cache files the malware created; audit all installed Chrome extensions and remove any that were not deliberately installed; change every password from a clean, uncompromised device; and transfer any cryptocurrency holdings to freshly generated wallets with new seed phrases.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
