The Guardio Labs experts have uncovered that cybercriminals are utilizing smart contracts on the Binance Chain (BNB) network to conceal and spread malicious software. They have named this hacking technique as EtherHiding.
This involves compromising WordPress sites by injecting JavaScript code, which then extracts the malware payload from the blockchain contracts.
This technique has been derived from the previously discovered ClearFake campaign.
The attackers initially used Cloudflare Workers to post the code for the second stage of the attack. However, this was blocked by the security company, possibly halting hacking attempts.
The hackers have specifically targeted the Web3 infrastructure of the BNB Chain network, which offers a nearly free and highly secure hosting solution backed by blockchain technology.
This allows them to easily and quickly change the code and attack methods at their discretion.
One of the methods observed by the experts involves tricking victims into updating their browser to access a certain content.
Upon clicking the link, the user unknowingly downloads malware that infects their computer from a domain controlled by the hackers.
