RevStealer spreads through 100+ domains and hijacked YouTube channels
The stealer takes browser secrets, game accounts, and wallets, then deletes itself after sending the data.
4
Stories per day · 30 days
3 RSS
Relatedinfostealer3revstealer2blockchain-c21clickfix1credential-theft1cryptocurrency-wallets1electron1gaming1indirect-syscalls1macos1phexia1youtube1
23 stories, newest first · one card per story
Stories tagged #etherhiding
ClickFix lures deliver Phexia malware that hides C2 via Polygon contracts
Phexia operators rotate C2 addresses by updating smart contracts; defenders should hunt Terminal commands and LaunchAgents.
Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials
Unit 42 says the ChainDrop npm worm uses Ethereum smart contracts as C2 to steal cloud and developer credentials.
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
CERT-UA says UAC-0277 used fake Cloudflare checks on over 100 sites to deliver LunexStealer.
8
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
ChainDrop and North Korea-linked PolinRider use blockchain C2 to steal cloud and CI/CD credentials.
6
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
CTM360 says ClickFix, now the top enterprise initial-access method, hides lure hosts on Polygon and delivers info-stealers.
2
Cybercriminals Abandon Domains but Keep the Hosting Networks Behind Malware Campaigns
Black Hills monitoring ties four ClickFix malware delivery chains to bulletproof host AS202412 (OMEGATECH LTD), making ASN-level blocking the durable defense.
2
WordPress Malware Uses Hidden Plugin and Blockchain C2 to Stay Undetected
Wordfence found WordPress malware that hides as a must-use plugin and uses Ethereum EtherHiding for command and control.
Stealthy WordPress Malware Uses Must-Use Plugin and Ethereum EtherHiding for Persistent Backdoor Access
Wordfence details a WordPress must-use plugin backdoor that steals credentials and hides C2 on Ethereum.
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
Checkmarx details malicious npm package indexed-btree hiding its loader in runtime code, netting €230,000; Socket flags PolinRider Packagist compromise.
3
ChainScript: the RAT that hides its command server inside a blockchain contract
New Node.js RAT 'ChainScript' hides command server in Polygon smart contract, spreading via ClickFix campaigns with fake Spotify/Zoom installers.
2
Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal Sensitive Credentials
New Remus Windows infostealer removes syscall hooks to evade EDR, stealing browser credentials, crypto wallets, and AI tool data via ClickFix lures and EtherHiding C2.
4
Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes
Malware operators hide C2 in Polygon blockchain contracts via EtherHiding, delivering a browser-based banking trojan that steals bank logins and 2FA codes from 479 sites.
3
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Blackpoint details new ChainScript RAT spread via ClickFix lures that uses a Polygon smart contract to rotate C2 infrastructure.
3
New Remus Infostealer Steals OpenAI and Anthropic API Tokens, Passwords and Crypto Wallets
SpyCloud Labs details Remus, a Windows infostealer harvesting AI platform API tokens, passwords, 2FA artifacts, and crypto wallets.
Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler discovered SloppyRAT, a ClickFix-delivered RAT that gives ransomware operators reconnaissance, remote execution, and SOCKS proxy pivoting for lateral movement.
2
Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware
Cisco Talos details ClickFix campaigns abusing fake Google CAPTCHA prompts, WebDAV and BNB Smart Chain to deploy the Amatera infostealer.
2
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.
1
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
2
ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain
A ClickFix social engineering campaign compromised 31 organizations, abusing the Polygon blockchain via EtherHiding for dynamically updated command-and-control.
2
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Gen Digital details WordlistLoader delivering Amatera Stealer via ClickFix and EtherHiding, while SynkLoader phishes Windows credentials through Microsoft Teams.
1
Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
McAfee says WeedHack infostealer MaaS still spreads via ten fake Minecraft client sites and SEO poisoning despite C2 takedown, with 116,464 infections logged.
2