Top Tweets for #etherhiding
How dangerous is #EtherHiding?
A Windows-only #ClickFix attack fetched code from a BSC Testnet contract on @BNBChain. It used dntds[.]shop and sdntds[.]shop.
Four days later, the payload was updated to use cloudfrontenterprise[.]com—no change to the compromised site.
#ThreatIntel
![sdcyberresearch's tweet photo. How dangerous is #EtherHiding?
A Windows-only #ClickFix attack fetched code from a BSC Testnet contract on @BNBChain. It used dntds[.]shop and sdntds[.]shop.
Four days later, the payload was updated to use cloudfrontenterprise[.]com—no change to the compromised site.
#ThreatIntel](https://pbs.twimg.com/media/HQexaOkXUAEWZKN.jpg)
![sdcyberresearch's tweet photo. How dangerous is #EtherHiding?
A Windows-only #ClickFix attack fetched code from a BSC Testnet contract on @BNBChain. It used dntds[.]shop and sdntds[.]shop.
Four days later, the payload was updated to use cloudfrontenterprise[.]com—no change to the compromised site.
#ThreatIntel](https://pbs.twimg.com/media/HQexaOYXQAAlaY5.jpg)
I had the pleasure of digging into some errTraffic v4 activity with @thehappydinoa and @SeraphimDomain this week in the @censysio dataset.
Here is a quick update on what we found.
🧵👇👇👇
#CENSYSARC #ThreatIntel #IOCs #errTraffic #etherhiding #webinjects
‼️ #ClickFix ed #EtherHiding: proseguono le campagne per la diffusione di codice malevolo
🔗 https://t.co/EPymkaH5uw
❌ non eseguire codice di dubbia provenienza
The abuse of #blockchain for #Magecart is continuing.
An additional 23 malicious domains were found hidden in smart contracts on the @ethereum Sepolia, bringing the total to 38 known contracts.
A full mapping of the contract IDs to their C2s is attached below. 👇
#EtherHiding #ThreatIntel #PCIDSS #DataSecurity #FormJacking #infosec #ecommerce #eskimming
"NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding" published by OpenSourceMalware. #NPM, #ContagiousInterview, #EtherHiding, #NullReceiver https://t.co/ZAX5cgYk0Q
"ClickFix, EtherHiding & a DPRK Wallet Trail" published by Allsecure. #ContagiousInterview, #ClickFix, #UNC5342, #EtherHiding https://t.co/rfbZaf9bqO
Tracing a live #ClickFix chain via #EtherHiding: lure page to Polygon smart contract to stager domain 🔍 #ErrTraffic https://t.co/JImYo6mJMT
ErrTraffic malware powers ClickFix attacks on hacked WordPress sites, using EtherHiding on the blockchain to hide its C2 and spread infostealers.
#ErrTraffic #ClickFix #EtherHiding #MaaS #WordPressSecurity #Infostealer #Malware
https://t.co/wwFtdO4lMh
McAfee Labs exposes a massive CountLoader campaign using EtherHiding and AMSI bypass to drop stealthy cryptocurrency clippers. Secure your assets!
#CountLoader #CryptoClipper #EtherHiding #CyberSecurity #InfoSec #MalwareAnalysis #CryptoTheft
https://t.co/xfJPc0Drjo
Apart from 2026 being the year of LLM-based security research and large supply chain attacks, I have the feeling it is going to be the year of #Etherhiding. ClickFix, Ransomware, APTs, Clipper malware, they all suddenly seem to realize that the blockchain is pretty bulletproof...
Part 2 is live 🔍
Followed the Ethereum wallet trail and found 4 more contracts, 2 live C2 domains, and a Russian comment in the source code.
The operator is actively iterating. The blockchain is forever.
https://t.co/wD03cSEolh
#ThreatIntel #Remus #EtherHiding #CTI #DFIR
eSentire exposes EtherRAT, a North Korean-linked backdoor using Ethereum smart contracts for "takedown-proof" C2. Protect your retail environment now.
#EtherRAT #Blockchain #CyberSecurity #InfoSec #NorthKorea #Malware #EtherHiding #RetailSecurity
https://t.co/a84zwfxe19
eSentire TRU reveals Iranian group Muddy Water deploying the Russian-linked Tsundere botnet, utilizing Ethereum smart contracts for stealthy C2 communication.
#TsundereBotnet #MuddyWater #CyberSecurity #ThreatIntel #eSentire #EtherHiding #Malware #InfoSec
https://t.co/pBbr1z2aXD
🎙️Episode online — #EtherHiding
North Korean-linked hackers are hijacking $ETH and $BNB to hide malware
This isn’t a bug. It’s a strategic exploitation of the infrastructure
They’re not hacking the blockchain
They’re using it against us
Analysis by ChaosBloom
#CyberSecurity
Fake Next.js job repos = real supply chain risk. Time to audit developer workflow security.
Post: https://t.co/7m196KXcGP
Website: https://t.co/yFF81iGEtm
#CyberSecurity #ISO27001 #InfoSec #DevSecOps #NextJS #JavaScript #VSCode #KimovaAI #LazarusGroup #EtherHiding #Polygon #AI
📸A career milestone: analyzed the #Kimwolf #botnet (1.83M nodes), smashing the previous #Vo1d record (1.68M). My largest to date.🎇
Learned lessions:
1: #Etherhiding is an effective countermeasure against C2 takeover. 🤔
2: Sleep early, or .. 5Head.😂
Happy hunting 🍷@Xlab_qax
Kimwolf botnet exposed: 1.8M+ infected Android TV boxes, 1.7B DDoS commands in 3 days
Uses blockchain domains to dodge takedowns. Operators taunting researchers: "we have 100s of servers keep trying LOL"
https://t.co/SQOKNSATmj
📌 [Dec 2025] #EtherRAT
▪ Node.js as runtime.
▪ Obtains C2 from an Ethereum smart contract (#EtherHiding).
▪ Resolves C2 through consensus among 9 RPC nodes.
▪ Maintains 5 simultaneous persistence layers.
▪ Implements AES-encrypted payload.
▪ Allows for self-obfuscation updates.
A compromised site revealed an #EtherHiding chain that combined decentralized staging, platform-aware logic, and user-driven execution.
The event provided a complete view of how blockchain storage, smart-contract evaluation, and social engineering operate as a unified workflow.
https://t.co/sHriuOQsm0
What is EtherHiding?
It's a novel technique where the attackers embed malicious payloads (like JADESNOW and INVISIBLEFERRET malware) within smart contracts on public blockchains (like BNB Smart Chain and Ethereum).
https://t.co/AyKeSuPyWW
🚨 ALERT: North Korean hackers are using a new malware, EtherHiding, to steal crypto by hiding in blockchain smart contracts! 💰 They've racked up over $2B in thefts this year, funding their nuclear ambitions. Stay vigilant, fam! 🔒 #CryptoSecurity #EtherHiding #Blockchain
Last Seen Hashtags on Sotwe
finansalköle
Seen from United States
meghancollison
Seen from United States
GaPol
Seen from United States
pintoawardsㅤㅤㅤ
Seen from France
democrats
Seen from United States
omegle
Seen from United States
نَحوكَ
Seen from Netherlands
بنت_اكابر
Seen from United States
momsonn filter:videos
momson
Seen from Italy
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
113.7M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.6M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.7M followers
KATY PERRY
@katyperry
89.6M followers
Taylor Swift
@taylorswift13
83.5M followers
Lady Gaga
@ladygaga
75M followers
Virat Kohli
@imvkohli
72.7M followers
Kim Kardashian
@kimkardashian
70.7M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
65.7M followers
Bill Gates
@billgates
64.9M followers
Selena Gomez
@selenagomez
62.6M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.8M followers