#ParsedReport #CompletenessHigh
17-09-2026

EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight

https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/

Report completeness: High

Threats:
Etherhiding_technique
Fakecaptcha_tool
Clickfix_technique
Bec_technique
Watering_hole_technique

Victims:
Legitimate business websites, End users, Financial institutions, Cryptocurrency services

Industry:
Financial

Geo:
North korea, Iran, North korean

TTPs:
Tactics: 9
Technics: 28

IOCs:
Domain: 22
Url: 4
IP: 1
Command: 1
Coin: 5
BrowserExtension: 1
Hash: 7

Soft:
WordPress, Windows Scheduled Task, OpenSSH, Chrome, Google Chrome

Crypto:
binance, ethereum

Algorithms:
xor, sha256, base64

Functions:
RPC

Win API:
polygon

Languages:
javascript, powershell