Executive Summary
A novel macOS campaign dubbed 'EtherHiding' has been identified, characterized by its use of smart contracts on the Polygon blockchain to host command-and-control (C2) infrastructure details. This technique, which functions as an evolution of DNS TXT dead drops, allows attackers to rotate infrastructure immutably and without relying on attacker-owned resolvers that can be seized by defenders. The activity is assessed with moderate confidence to be linked to the DPRK-nexus 'Contagious Interview' campaign, where victims are socially engineered during fake technical interviews to execute malicious code.
The attack chain involves initial access via malicious shell scripts, followed by persistence established through macOS Launch Agents. These agents execute obfuscated AppleScript payloads that query a specific smart contract on the Polygon network via public RPC providers. This keyless, read-only 'eth_call' retrieves the current C2 domain, which is then used to fetch second-stage payloads. Because blockchain transactions are permanent, analysts can reconstruct the complete C2 rotation history and identify operator wallet clusters.
This threat is particularly significant for organizations with macOS workstations, as the fileless nature of the execution and the use of legitimate blockchain infrastructure can bypass standard endpoint and network security controls. The operator's ability to rotate domains weekly necessitates monitoring the smart contract itself rather than individual domains.