RemusStealer is a malware-as-a-service program exhibiting multiple similarities to LummaStealer, including anti-virtual machine checks, credential theft tactics, and Application-Bound Encryption bypass methods. A key distinction is RemusStealer's use of Ethereum smart contracts for C2 communications instead of Steam or Telegram dead drop resolvers. Written in Go, the stealer performs extensive system discovery, gathering information about antivirus products, hardware specifications, and operating systems. It employs hidden desktop environments to evade detection while launching Microsoft Edge and Brave browser processes on non-primary window stations to steal credential files. The malware establishes connections to suspicious domains ending in .shop or .biz and communicates with Ethereum-related infrastructure. This evolution demonstrates attackers' increasing sophistication in leveraging blockchain technology to masquerade malicious communications through smart contracts.
Over a five-month period, multiple malicious campaigns operated through a single bulletproof hosting provider, AS202412 registered to OMEGATECH LTD in Seychelles. These campaigns used disposable domains, fake CAPTCHA pages to trick victims into executing commands, and compromised legitimate websites. The infrastructure included cloud storage, blockchain-resolved command and control addresses, and trojanized installers. Although many victims did not proceed beyond the lure page, successful infections deployed information stealers and remote access tools with persistence mechanisms that survive system reboots.
ChainScript is a Node.js remote access trojan (RAT) identified by Blackpoint's Adversary Pursuit Group. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams via malicious Windows Installer packages. The malware uses a Polygon blockchain smart contract to dynamically discover its command and control (C2) infrastructure, allowing operators to rotate backend services without rebuilding agents. ChainScript offers extensive remote access features including shell access, file operations, screenshots, payload deployment, cryptocurrency wallet discovery, remote JavaScript execution, self-updating, and cleanup. Multiple builds with different names share the same core architecture.
In June 2026, a new malware family named SloppyRAT was identified, likely used by ransomware-related threat actors to establish footholds for lateral movement. Delivered through multi-stage ClickFix infection chains, the malware features encrypted code blocks, EtherHiding for command-and-control resolution via Polygon JSON-RPC protocol, and multiple anti-analysis techniques including junk code and indirect system calls. SloppyRAT implements certificate pinning to prevent TLS traffic inspection and includes 47 built-in PowerShell-like commands for remote access. The infection chain uses finger.exe, IronPython, and deploys CastleLoader and CastleRAT components before installing SloppyRAT. Despite sophisticated capabilities, the codebase contains numerous software bugs affecting persistence mechanisms and other features, suggesting active development.
An investigation revealed a sophisticated cryptocurrency and credential-stealing operation using Amatera stealer as the primary payload. The attack chain leverages Cloudflare Workers to inject JavaScript stored on BNB Smart Chain, presenting fake Google CAPTCHA prompts that lead to WebDAV-based DLL execution. Two parallel infection chains were identified, one loading through a DLL named 'pf.ch' and another through 'verification.google', both delivering Amatera stealer with different secondary payloads. The 'pf.ch' variant deployed ZigCryptoStealer via NativeAOT loader and a Go-based reverse proxy, while the 'verification.google' variant installed NetSupport Manager with C2 infrastructure in Russia. The operation affects numerous countries with primary focus on stealing cryptocurrency wallets, credentials from password managers, and various authentication data through extensive collection rules targeting over 400 applications.
Since February 2026, there has been a resurgence of attacks abusing Node.js, targeting government, technology, and hospitality sectors. Attackers use the legitimate, signed node.exe binary to execute malicious JavaScript payloads, bypassing signature-based detection. Notable incidents include compromises of an Asian technology company and a U.S. fintech firm, involving advanced techniques such as EtherHiding and deployment of Rust-based backdoors linked to ransomware operations. Multiple attacks involve ModeloRAT, associated with initial access broker Woodgnat, connected to various ransomware families. Attackers combine living-off-the-land tactics with commodity malware and employ ClickFix techniques for initial access.
A Magecart campaign uses EtherHiding techniques to perform card-skimming on e-commerce platforms. Attackers compromise legitimate online storefronts, mainly WooCommerce, but also PrestaShop, Magento, and WordPress sites, injecting malicious loaders disguised as Google Tag Manager code. The skimming payloads are staged inside Ethereum blockchain smart-contract storage, making detection more difficult. Over 40 websites across 15 countries have been impacted since April 2026. The infrastructure involves 144 Sepolia contracts controlled by a single wallet, with 20 distinct contracts and skimmer-hosting domains identified. The malicious code appears as normal analytics but steals credit card data from shoppers.
A sophisticated multi-stage loader dubbed PavinLoader has been identified across multiple distribution campaigns including ClickFix attacks, fake software downloads, and malicious RenPy games. The loader employs heavily obfuscated .NET DLLs, abuses legitimate Windows tools like MSBuild, and utilizes EtherHiding technique to retrieve command-and-control domains via blockchain. The infection chain consists of four main stages: a Loader DLL performing anti-forensics, an EtherHiding Loader obtaining C2 infrastructure, an Anti-Analysis DLL checking for virtualized environments, and a PE Loader delivering final payloads including Amatera Stealer. Evidence suggests PavinLoader may be offered as a Loader-as-a-Service, with common artifacts found across over 200 related files. The campaigns demonstrate sophisticated evasion techniques including custom obfuscation, API hashing, and extensive anti-analysis checks targeting virtualized environments and specific geographic regions.
A masqueraded scheduled task alert triggered an aggressive threat hunt that uncovered a complete FakeAgent intrusion campaign within ten minutes using an automated threat hunting agent. The campaign leveraged malvertising on Bing to distribute trojanized Claude Desktop installers hosted on legitimate Anthropic infrastructure. The attack chain featured DLL sideloading via Java Chromium Embedded Framework, Microsoft Defender tampering, scheduled task persistence masquerading as Microsoft Edge updates, and blockchain-based command-and-control infrastructure using EtherHiding techniques. The hunting agent executed correlated queries across multiple kill chain phases simultaneously, providing confidence-scored findings that enabled rapid validation and remediation. The intrusion delivered SectopRAT malware with infostealing and remote desktop capabilities, requiring full endpoint reimaging and credential resets.
This macOS malware campaign uses social engineering via fake CAPTCHA pages to trick users into running malicious AppleScript commands. It deploys a persistent backdoor that leverages EtherHiding by storing command-and-control (C2) addresses in Polygon blockchain smart contracts, complicating detection. The malware maintains persistence through LaunchAgents and delivers multiple payloads including the AMOS stealer, which targets cryptocurrency wallets, browser credentials, and macOS Keychain data, as well as the XMRig cryptominer for ongoing revenue. The campaign employs advanced evasion techniques such as character-ID obfuscation and abuse of legitimate macOS utilities. Blockchain transaction analysis reveals the full history of C2 infrastructure rotation and funding, aiding defenders despite the malware's memory-resident nature.
On August 4, 2026, ChainDrop, a self-propagating worm variant of Mini Shai-Hulud linked to TeamPCP, infiltrated the npm ecosystem through a compromised maintainer account of the keyv ecosystem. The attacker injected malicious code into GitHub repositories, weaponizing legitimate CI/CD pipelines to publish poisoned packages with valid SLSA Build Level 3 provenance attestations, making them indistinguishable from clean releases. ChainDrop spread to over 400 packages within four hours by stealing npm tokens and republishing infected versions. The worm employs Ethereum smart contracts for C2 infrastructure, enabling domain rotation without modifying deployed malware. It features destructive capabilities, wiping victim home directories upon token revocation, and achieves persistence through IDE and AI-agent configuration files. The payload harvests credentials from npm, GitHub, AWS, Azure, GCP, Kubernetes, HashiCorp Vault, and other services, exfiltrating data via GitHub repositories and EtherHiding techniques.
In April 2026, a Malware-as-a-Service NodeJS infostealer campaign evolved its delivery methods, shifting from ClickFix social engineering to weaponized GitHub repositories. Attackers clone legitimate AI-related repositories and developer tools, subtly embedding malicious payloads that target developers and AI users. The campaign employs SmartLoader in a redundant two-stage loader chain, with both stages using EtherHiding to resolve C2 addresses from Polygon blockchain smart contracts at runtime. This technique enables operators to redirect all implants by updating blockchain values without code modification. The first stage uses Prometheus-obfuscated Lua scripts, while the second stage likely uses MoonSec obfuscation. Victims are primarily located in North America, Asia, and Southern Europe, with financial services, banking, and technology sectors most affected. The campaign delivers various infostealers including previously documented NodeJS variants, specifically targeting developers' elevated privileges...
A malvertising campaign targeted 29 organizations by exploiting the legitimate Claude.ai domain to distribute a fake ClaudeDesktop.exe containing the SectopRAT remote access trojan. The campaign used advanced anti-analysis techniques such as VMProtect packing, GPU-based VM detection, and DirectX shader-based payload decryption. The malware's command-and-control infrastructure leveraged Ethereum blockchain transactions (EtherHiding) to hide C2 addresses, enhancing resilience against takedowns. SectopRAT exfiltrated sensitive data including credit card information, credentials, browser data, and personal files. The campaign infrastructure is linked to previous operations dating back to December 2025 and associated with known threat groups.
Threat actors exploited the EtherHiding technique to store ClearFake payload routing instructions within smart contracts on the BNB Smart Chain testnet, creating an immutable command-and-control infrastructure that cannot be taken down. The attack began with injected JavaScript on a compromised Swiss website that queried blockchain contracts to deliver malicious payloads. Victims passing anti-analysis checks were fingerprinted by operating system and routed to platform-specific ClickFix social engineering overlays. The campaign simultaneously deployed SectopRAT, a .NET-based remote access trojan capable of browser session hijacking, and ACRStealer, a C++ infostealer targeting credentials and cryptocurrency wallets. An on-chain execution tracker confirmed each compromise in real time. Four smart contracts shared a single deployer wallet, with the oldest deployed nearly a year before analysis, indicating a long-running, actively maintained operation.
A sophisticated 64-bit information-stealing malware named Remus has emerged as a direct evolution of the notorious Lumma Stealer. Following the doxxing of alleged Lumma core members between August and October 2025, developers created this advanced variant, with test builds appearing in September 2025 and live campaigns starting February 2026. Remus employs innovative techniques including injecting custom 51-byte shellcode into browser memory to extract protected master keys, bypassing Application-Bound Encryption in Chromium-based browsers. The malware utilizes EtherHiding through Ethereum smart contracts for command-and-control resolution, making infrastructure takedowns nearly impossible. It targets browser credentials, session cookies, and cryptocurrency wallets while implementing rigorous anti-analysis checks to evade security research environments.
Gen Threat Labs has identified Remus, a new 64-bit infostealer attributed to the Lumma Stealer family, emerging after Lumma's takedown and the doxxing of its alleged core members. First campaigns date back to February 2026, with the malware switching from Steam/Telegram dead drop resolvers to EtherHiding and employing new anti-analysis checks. Remus shares multiple characteristics with Lumma including identical string obfuscation techniques, AntiVM checks, direct syscall/sysenter handling, indirect control flow obfuscation, and a unique Application-Bound Encryption bypass. The analysis details test builds labeled Tenzor from September 2025, representing a transitional step between Lumma and Remus. While maintaining Lumma's stealing arsenal for browser passwords, cookies, and cryptocurrency, Remus introduces blockchain-based C2 resolution via EtherHiding, additional anti-sandbox checks targeting analysis tool DLLs, and enhanced device fingerprinting capabilities.
EtherRAT, a Node.js-based backdoor linked to a North Korean APT group, was detected in a retail customer's environment. It allows arbitrary command execution, extensive system information gathering, and asset theft. The malware uses 'EtherHiding' to store C2 addresses in Ethereum smart contracts, making infrastructure resilient to takedowns. It communicates using CDN-like beaconing to blend with normal traffic. Initial access varied, including ClickFix and IT Support scams via Microsoft Teams. A SYS_INFO module performs comprehensive host fingerprinting for target selection. The malware checks for CIS languages and self-destructs if found. It collects detailed system information, including hardware, software, and network details.
A sophisticated phishing campaign impersonating Tesseract OCR was discovered, utilizing typosquatting and ClickFix techniques. The attack chain, named OCRFix, employed multi-stage malware deployments with heavy obfuscation and defense evasion techniques, including EtherHiding. The campaign used BNB Smart Chain TestNet to hide C2 domains through smart contracts. The malware delivery process involved three stages: a loader, a secondary loader for persistence, and a bot listener. The final payload connected to a bot control panel, allowing attackers to manage infected hosts and deploy additional malware. The campaign demonstrated a combination of simple initial access methods with complex delivery chains, highlighting the ongoing effectiveness of techniques like ClickFix and the importance of robust phishing defenses.
UNC5142, a financially motivated threat actor, has been tracked since late 2023 for abusing blockchain technology to distribute infostealers. The group exploits vulnerable WordPress sites and employs the 'EtherHiding' technique to obscure malicious code on the BNB Smart Chain. Their infection chain involves a multistage JavaScript downloader called CLEARSHORT, compromised WordPress sites, and smart contracts. UNC5142 has evolved its tactics, using a three-level smart contract system for dynamic payload delivery and abusing legitimate services like Cloudflare Pages. The group has distributed various infostealers, including ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF. Their operations have impacted multiple industries and geographic regions, with approximately 14,000 compromised web pages identified as of June 2025.
North Korean threat actor UNC5342 employs a novel malware delivery technique called 'EtherHiding,' embedding malicious code within smart contracts on public blockchains to create resilient command-and-control infrastructure. The attack chain begins with social engineering, targeting cryptocurrency and technology sector developers via fake recruitment schemes. Loader scripts are injected to fetch payloads from multiple blockchains and API services, complicating detection and mitigation. The malware suite includes JADESNOW, BEAVERTAIL, and INVISIBLEFERRET, which enable data theft and remote control of infected systems. This approach leverages the decentralized and immutable nature of blockchains to evade takedown efforts. The campaign primarily facilitates cryptocurrency theft and espionage. Exploitation does not require prior authentication but relies on user interaction through social engineering. The threat is medium severity but poses significant challenges due to its innovative use of blockchain technology for malware command and control.
