Ethereum-Based EtherRAT, EtherHiding Power Stealthy Malware Campaigns

**Executive Summary:** eSentire’s Threat Response Unit (TRU) observed EtherRAT, a Node.js backdoor that harvests credentials and crypto wallets, performs extensive host fingerprinting, and uses an Ethereum smart contract (EtherHiding) to retrieve and rotate resilient C2 endpoints; intrusions were delivered via IT support scams, ClickFix, and LOLBin abuse and employed heavy JavaScript obfuscation and reobfuscation to evade detection. TRU contained a March 2026 incident and recommends blocking unnecessary crypto RPC providers, deploying NGAV/EDR, disabling mshta.exe/pcalua.exe where possible, and enhancing phishing and IT‑support scam awareness.