Hackers Hide Malicious Server Addresses Inside Fake Ethereum Transactions

Security researchers have identified a new twist on the 'EtherHiding' technique, where attackers hide the address of their command-and-control (C2) server inside blockchain transactions rather than in the malicious code itself. This makes it much harder for security tools to detect and block the malware, since blockchain transactions look legitimate and are not typically flagged as suspicious.

The new method, dubbed 'NullReceiver,' was discovered in two trojanized npm packages: 'bianira-ui' and 'fluid-type-ui.' Instead of storing the C2 server's IP address directly in the malicious code, attackers encode it into a fake, made-up recipient address used in an empty Ethereum transfer. When the malware runs, it decodes this address to find the real server it needs to contact, allowing the attacker to hide their infrastructure in plain sight on the public blockchain.

This technique highlights how attackers are increasingly using blockchain technology to make malware harder to detect and take down, since blockchain data is decentralized and difficult to remove once published. For small businesses relying on open-source software packages, this is a reminder that supply chain attacks—where malicious code is hidden inside seemingly normal software components—remain a serious and evolving threat.