EtherHiding Campaign Serving Amatera via Blockchain

A large-scale cybercriminal operation has compromised over 5,400 small-business websites (primarily WordPress and PrestaShop) to facilitate an sophisticated attack chain known as EtherHiding. By storing malicious payloads in smart contracts on the BNB Smart Chain (BSC) Testnet and Base networks, attackers create a resilient, takedown-resistant infrastructure that bypasses traditional file-based detection.

The campaign utilizes 'ClickFix' lures, which trick users into manually executing malicious PowerShell commands by spoofing CAPTCHA or browser update prompts. Recent variants have shifted toward covert WebRTC data-channel stagers that forge handshakes to bypass network security proxies, ultimately deploying the Amatera password stealer (a rebrand of ACR Stealer) for data exfiltration.

This activity is highly evasive, using polyglot files (MP3/HTA), fileless execution, and steganography to minimize on-disk footprints. The widespread impact across various sectors highlights the urgent need for organizations to monitor for unusual blockchain RPC traffic and WebRTC handshake anomalies.