Hackers Turned Ethereum Into a Secret Messaging System for Malware

A North Korea-linked malware campaign has found a way to keep infected computers connected to its operators. Instead of storing malware on Ethereum, the attackers hide the location of a control server inside cryptocurrency transfers. The campaign reaches developers through fake job offers, tainted code repositories and malicious software packages. Running the code can install a remote access tool and a credential stealer across Windows, macOS and Linux. Researchers from Ransom-ISAC identified the new Ethereum component in September 2026 samples of XCTDH. Ransom-ISAC said in a report shared with Cyber Security News (CSN) that the technique gives the malware another…