North Korean EtherHiding Campaign Targets Crypto Wallets and Developer Credentials

AllSecure researchers identified a North Korean-linked campaign that uses fake macOS update pages delivered via malvertising to trick victims into pasting Terminal commands that install a Node.js remote access trojan and infostealer. The malware uses Ethereum smart contracts (EtherHiding) to retrieve live C2 configuration, deploys a malicious Chrome MV3 extension disguised as "Google Drive Offline," collects credentials and crypto wallets, and establishes persistence; researchers observed substantial cryptocurrency movement tied to the operation and provided IoCs and containment guidance.