Hackers find a new way to distribute malware by hiding malicious code in Blockchains
Even when you don't think you're under attack you are ...
Key takeaways
- Cybercriminals have discovered a new way to spread malware to unsuspecting users, this time by manipulating BNB Smart Chain (BSC) smart contracts to hide malware and disseminate malicious code.
- The attackers hide the payloads in BSC smart contracts, essentially serving as anonymous free hosting platforms for them.
- The hackers can update the code and change the attack methods at will.
Cite or link to this article
Griffin, M. (2024) 'Hackers find a new way to distribute malware by hiding malicious code in Blockchains', 311 Institute, 22 March. Available at: https://www.311institute.com/hackers-find-a-new-way-to-distribute-malware-by-hiding-malicious-code-in-blockchains/ (Accessed: 1 October 2026).
Cybercriminals have discovered a new way to spread malware to unsuspecting users, this time by manipulating BNB Smart Chain (BSC) smart contracts to hide malware and disseminate malicious code. A breakdown of the technique known as “EtherHiding” was shared by security researchers at Guardio Labs in an March report, explaining that the attack involves compromising WordPress websites by injecting code that retrieves partial payloads from the blockchain contracts.
The attackers hide the payloads in BSC smart contracts, essentially serving as anonymous free hosting platforms for them. The hackers can update the code and change the attack methods at will. The most recent attacks have come in the form of fake browser updates, where victims are prompted to update their browsers using a fake landing page and link.
The Future of Cyber Security, by keynote futurist Matthew Griffin
The payload contains JavaScript that fetches additional code from the attacker’s domains. This eventually leads to full site defacement with fake browser update notices that distribute malware.
This approach allows the threat actors to modify the attack chain by simply swapping out malicious code with each new blockchain transaction. This makes it challenging to mitigate, according to Nati Tal, head of cybersecurity at Guardio Labs, and fellow security researcher Oleg Zaytsev.
Once the infected smart contracts are deployed, they operate autonomously. All Binance can do is rely on its developer community to flag malicious code in contracts upon discovery.
Guardio stated that website owners using WordPress, which runs roughly 43% of all websites, need to be extra vigilant with their own security practices before adding:
“WordPress sites are so vulnerable and frequently compromised, as they serve as primary gateways for these threats to reach a vast pool of victims.”
The firm concluded that Web 3.0 and blockchain bring new possibilities for malicious campaigns to operate unchecked. “Adaptive defenses are needed to counter these emerging threats,” it said.
What this means for your organisation
Takedowns get harder.
Code stored on a blockchain cannot easily be removed. Attackers can swap payloads at will. Security teams should focus on blocking delivery, not removal.
Websites are the gateway.
Compromised WordPress sites serve the attack to visitors. WordPress runs a large share of the web. Site owners should patch, monitor and lock down admin access.
Fake updates fool users.
Victims are tricked by fake browser update pages. Awareness is a key defence. Train staff never to install updates from web pages.
Three questions for your next leadership meeting
- How well are our websites protected from compromise?
- Do our staff know not to install updates from web pages?
- How would we detect if our site served malicious code?
The trends and technologies behind this story
From the 311 Starburst, the 311 Strategic Intelligence Unit’s map of the technologies and trends shaping the next 50 years.
Analysis by the 311 Strategic Intelligence Unit, from Matthew Griffin’s article and 311 data. First published on Fanatical Futurist.
FAQ
Why does this matter?
Even when you don't think you're under attack you are ...
About the author
Matthew Griffin Founder, 311 Institute
Matthew Griffin is a multi-award winning Futurist and expert in Disruption and Innovation, Geopolitics, Leadership, and Technology, who NASA have described as a "walking encyclopaedia of the future" and a "futurist Polymath."
Read full bio
Matthew Griffin is a multi-award winning Futurist and expert in Disruption and Innovation, Geopolitics, Leadership, and Technology, who NASA have described as a "walking encyclopaedia of the future" and a "futurist Polymath." 17-time best selling author of the "Codex of the Future" series, Matthew is the Founder and Futurist in Chief of the 311 Institute, a global Futures and Deep Futures advisory firm working with royal households, world leaders, G7, G20, and G77 governments, NGOs, and multi-national mid and mega cap firms to help them explore, shape, and lead the next 50 years of business and society.
An award-winning YouTube creator with over a million followers, with an unrivalled global reach and impact, Matthew is a highly sought-after international keynote speaker, lecturer, and mentor who collaborates with global leaders through the United Nations Alliance of Civilizations (UNAOC) and United Nations General Assembly (UNGA) to shape pivotal initiatives such as the UN’s AI for Humanity program, the United Nations Conference of the Parties (UN COP), and the World Economic Forum in Davos.
As the former Global Head of Cloud, National Security, and Enterprise Sales for companies including Atos, Dell-EMC, and IBM, Matthew has a proven track record of building multi-billion dollar business units and turning failing divisions into market leaders. His ability to identify, analyse, and communicate the implications of hundreds of emerging technologies and trends is unparalleled, and his insights are trusted by many of the world’s most respected organisations, including ABB, Accenture, Adidas, AON, ARM, BCG, Centrica, Citi, Coca-Cola, Dentons, Deloitte, Dow Jones, EY, Google, KPMG, Lego, Legal & General, LinkedIn, Microsoft, PepsiCo, Qualcomm, RWE, Samsung, Siemens AG and Siemens Energy, T-Mobile, UBS, VISA, Walmart, Workday, Worldpay and many others.
Regularly featured in the global media including the AP, BBC, Bloomberg, CNBC, Discovery, Forbes, Khaleej Times, Telegraph, TIME, ViacomCBS, WIRED, and the WSJ, Matthews mission is to help organisations create a fair and sustainable future whose benefits are shared by everyone irrespective of their ability, background, or circumstances.
What future do you need to see?
Choose one to get started on security and privacy and the future of your organisation.
Sources and further reading
Source: first published by the 311 Institute on 22 March 2024. Cite as: Griffin, M. (2024). Hackers find a new way to distribute malware by hiding malicious code in Blockchains. 311 Institute. https://www.311institute.com/hackers-find-a-new-way-to-distribute-malware-by-hiding-malicious-code-in-blockchains/
You are welcome to quote this article with credit and a link to the original.