North Korean hackers use EtherHiding to hide malware on the blockchain

North Korean-linked APT UNC5342 has been observed using 'EtherHiding'—embedding payloads in smart contracts on Ethereum and BNB Smart Chain—to stealthily host and deliver a JavaScript downloader (JADESNOW) in recruiter-style social-engineering job interviews. The downloader retrieves an in-memory JavaScript version of InvisibleFerret and credential-stealing components that target browser-stored passwords, payment cards, and cryptocurrency wallets (MetaMask, Phantom); attackers exploit read-only blockchain calls for stealth, update contracts cheaply and across multiple chains, complicating detection and takedown.