North Korean EtherHiding Campaign Targets Crypto Wallets and Developer Credentials
You're staring at what looks like a frozen macOS screen. A page tells you to copy a Terminal command and paste it to "fix" the update. That single paste is the entire infection.
According to analysts at AllSecure, a North Korean-linked campaign is using exactly this ClickFix-style lure to drop an obfuscated remote access trojan, and the target list includes your crypto wallet, your browser sessions, and — if you're a builder — your developer keys.
How the chain actually works
The lure replaces your browser tab with a fake macOS update or reboot screen. The malicious page silently copies a command to your clipboard. You paste it into Terminal. A dropper installs Node.js and launches an obfuscated RAT. From that point the attacker owns the box.
The clever part is what happens next. The malware does not phone home to a fixed server. It queries Ethereum smart contracts for live command-and-control instructions — a technique researchers call EtherHiding. The smart contract acts as a resilient configuration layer: takedowns of the traditional infrastructure do nothing, because the attackers can point the contract at new servers without touching the malware already on your machine. The backdoor checks in roughly every five minutes and executes whatever JavaScript the operators push. Two Ethereum configuration contracts are embedded in the sample, routing the backdoor and the malicious browser extension to separate infrastructure.
Persistence is layered. The malware plants LaunchAgent entries, modifies shell profiles, and stashes hidden files in cache directories so it survives reboots. After that, an infostealer sweeps the system for data from 157 cryptocurrency wallet types, browser passwords, cookies, history, bookmarks, SSH material, cloud credentials, npm config files, and Foundry keystores that may expose development environments. Finally, a malicious Chrome extension disguised as "Google Drive Offline" is installed silently — requesting browser debugging, cookie access, native messaging, and access to all URLs, giving the operators a persistent eye inside your browser.
Why this hits NFT traders specifically
If you trade on marketplaces from macOS, this campaign is in scope. The malicious Chrome extension sits inside the same browser where you connect MetaMask, Rabby, or Phantom and approve listings and bids. A hijacked extension can rewrite what you sign. The stolen developer credentials are the bigger prize: cloud keys, source-control tokens, and Foundry keystores can cascade into project repos and corporate infrastructure, not just personal wallet drain.
The delivery mechanism also matters. This is not a phishing email or a fake job-interview coding test — those North Korean patterns are still active, but this campaign widens the lure to routine web browsing, which means even non-developer collectors are now in the kill chain.
What to do right now
Do not paste Terminal commands from any web page, ever. macOS does not ask you to fix updates by typing into Terminal.
1. Isolate first. If you ran any pasted command in the last weeks, take the machine off the network. Do not log into wallets from it again.
2. Audit Chrome extensions. Open chrome://extensions, enable Developer Mode, and verify every installed extension's ID and hash against the official source. Remove anything you did not intentionally install — especially anything labeled Google Drive Offline.
3. Check persistence. Review ~/Library/LaunchAgents for unfamiliar .plist files. Inspect your ~/.zshrc and ~/.bash_profile for exports or aliases you did not write. Scan ~/Library/Caches for hidden directories.
4. Rotate credentials from a clean device. Browser-saved passwords, npm tokens, GitHub PATs, cloud provider keys, SSH keys, and Foundry keystores — assume all of them are burned if that machine was exposed.
5. Revoke every wallet approval. Open your wallet's "Connected Sites" or approval manager. Revoke all approvals. Move long-term holdings to a fresh wallet generated on a clean device or hardware signer.
6. Rebuild, don't clean. A factory reset and clean macOS install is the only reliable remediation once an obfuscated RAT with multi-layer persistence has executed. Malware cleaners are not enough.
The uncomfortable truth: if the clipboard command was pasted, the box is no longer yours. Treat it accordingly, and build your trading setup so the next campaign finds nothing worth stealing.