Security researchers warn of a two-phase attack that uses compromised websites and on-chain code to steal funds and data
Security teams are sounding the alarm over “EtherHiding,” a multi-stage malware technique that links compromised websites to malicious logic embedded in public smart contracts — enabling attackers to siphon crypto and harvest sensitive information while minimizing traceable on-chain footprints.
The method unfolds in two phases. First, attackers take control of a legitimate website and insert a loader script that serves JavaScript to visitors. That script then interacts with a smart contract using read-only calls, allowing the site to query and trigger off-chain behavior without creating visible transactions. In the second phase, the smart contract’s logic coordinates with the infected page to prompt victims to sign transactions or to exfiltrate credentials when users follow social-engineering prompts.
“Compromised websites act as trusted delivery channels, and the smart contract provides a persistent, public command-and-control layer,” said a cybersecurity analyst. “That combination is what makes EtherHiding especially hard to detect with conventional tools.”
Attackers typically begin contact through elaborate social engineering: fake job offers, technical interviews, and coding tasks routed to messaging platforms. Targets are urged to download packages from public code repositories or to install a supposed “patch” during a staged video call. Once installed, the initial payload deploys a JavaScript backdoor — reported in some cases as the JADESNOW module — which harvests keys, clipboard data, and wallet signatures.
Key features of EtherHiding include:
- Use of legitimate websites as infection vectors
- Read-only blockchain calls to avoid gas costs and reduce visibility
- Multi-stage payloads (data exfiltration, credential theft, persistent access)
A blockchain security researcher added, “Embedding coordination logic in a smart contract leverages the immutability and ubiquity of on-chain code — once deployed, it’s globally accessible and hard to take down quickly.”
Defensive recommendations emphasize strict verification of recruitment contacts, avoiding unsolicited code downloads, auditing third-party webpages before use, and using hardware wallets for signing sensitive transactions. Organizations should also monitor website integrity and scan for unexpected JavaScript changes.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.