Threat actors have found a new way to deliver malicious software, commands, and links inside Ethereum smart contracts to evade security scans as attacks using code repositories evolve.
Cybersecurity researchers at digital asset compliance firm ReversingLabs have found new pieces of open-source malware discovered on the Node Package Manager (NPM) package repository, a large collection of JavaScript packages and libraries.
The malware packages “employ a novel and creative technique for loading malware on compromised devices — smart contracts for the Ethereum blockchain,” ReversingLabs researcher Lucija Valentić said in a blog post on Wednesday.
The two packages, “colortoolsv2” and “mimelib2,” published in July, “abused smart contracts to conceal malicious commands that installed downloader malware on compromised systems,” explained Valentić.
To avoid security scans, the packages functioned as simple downloaders and instead of directly hosting malicious links, they retrieved command and control server addresses from the smart contracts.
When installed, the packages would query the blockchain to fetch URLs for downloading second-stage malware, which carries the payload or action, making detection more difficult since blockchain traffic appears legitimate.
NPM packages ‘colortoolsv2’ and ‘mimelib2’ on GitHub. Source: ReversingLabs
A new attack vector
Malware targeting Ethereum smart contracts is not new; it was used earlier this year by the North Korean-affiliated hacking collective the Lazarus Group.
“What is new and different is the use of Ethereum smart contracts to host the URLs where malicious commands are located, downloading the second-stage malware,” said Valentić, who added:
“That’s something we haven’t seen previously, and it highlights the fast evolution of detection evasion strategies by malicious actors who are trolling open source repositories and developers.”
An elaborate crypto deception campaign
The malware packages were part of a larger, elaborate social engineering and deception campaign primarily operating through GitHub.
Threat actors created fake cryptocurrency trading bot repositories designed to look highly trustworthy through fabricated commits, fake user accounts created specifically to watch repositories, multiple maintainer accounts to simulate active development, and professional-looking project descriptions and documentation.
Related: Crypto users warned as ads push malware-laden crypto apps
Threat actors are evolving
In 2024, security researchers documented 23 crypto-related malicious campaigns on open-source repositories, but this latest attack vector “shows that attacks on repositories are evolving,” combining blockchain technology with elaborate social engineering to bypass traditional detection methods, Valentić concluded.
These attacks are not only executed on Ethereum. In April, a fake GitHub repository posing as a Solana trading bot was used to distribute obscured malware that stole crypto wallet credentials. Hackers have also targeted “Bitcoinlib,” an open-source Python library designed to make Bitcoin development easier.
Magazine: Bitcoin to see ‘one more big thrust’ to $150K, ETH pressure builds: Trade Secrets

<div><div><p>Threat actors have found a new way to deliver malicious software, commands, and links inside Ethereum smart contracts to evade security scans as attacks using code repositories evolve. </p><adv></adv><p>Cybersecurity researchers at digital asset compliance firm ReversingLabs have found new pieces of open-source malware discovered on the Node Package Manager (NPM) package repository, a large collection of JavaScript packages and libraries.</p><adv></adv><p>The malware packages “employ a novel and creative technique for loading malware on compromised devices — smart contracts for the Ethereum blockchain,” ReversingLabs researcher Lucija Valentić said in a blog post on Wednesday.</p><p>The two packages, “colortoolsv2” and “mimelib2,” published in July, “abused smart contracts to conceal malicious commands that installed downloader malware on compromised systems,” explained Valentić. </p><p>To avoid security scans, the packages functioned as simple downloaders and instead of directly hosting malicious links, they retrieved command and control server addresses from the smart contracts. </p><p>When installed, the packages would query the blockchain to fetch URLs for downloading second-stage malware, which carries the payload or action, making detection more difficult since blockchain traffic appears legitimate.</p><div><img src="https://cnews24.ru/uploads/cda/cda3b1244eb0b420f7fa38f47bf4ee925f9f9f88.jpg" title=""><div><em>NPM packages ‘colortoolsv2’ and ‘mimelib2’ on GitHub. Source: </em><em>ReversingLabs</em></div></div><h2>A new attack vector </h2><p>Malware targeting Ethereum smart contracts is not new; it was used earlier this year by the North Korean-affiliated hacking collective the Lazarus Group.</p><p>“What is new and different is the use of Ethereum smart contracts to host the URLs where malicious commands are located, downloading the second-stage malware,” said Valentić, who added: </p><blockquote>“That’s something we haven’t seen previously, and it highlights the fast evolution of detection evasion strategies by malicious actors who are trolling open source repositories and developers.”</blockquote><h2>An elaborate crypto deception campaign</h2><p>The malware packages were part of a larger, elaborate social engineering and deception campaign primarily operating through GitHub. </p><p>Threat actors created fake cryptocurrency trading bot repositories designed to look highly trustworthy through fabricated commits, fake user accounts created specifically to watch repositories, multiple maintainer accounts to simulate active development, and professional-looking project descriptions and documentation.</p><p><em><strong>Related: </strong></em><em><strong>Crypto users warned as ads push malware-laden crypto apps</strong></em></p><h2>Threat actors are evolving </h2><p>In 2024, security researchers documented 23 crypto-related malicious campaigns on open-source repositories, but this latest attack vector “shows that attacks on repositories are evolving,” combining blockchain technology with elaborate social engineering to bypass traditional detection methods, Valentić concluded. </p><p>These attacks are not only executed on Ethereum. In April, a fake GitHub repository posing as a Solana trading bot was used to distribute obscured malware that stole crypto wallet credentials. Hackers have also targeted “Bitcoinlib,” an open-source Python library designed to make Bitcoin development easier.</p><p><em><strong>Magazine: </strong></em><em><strong>Bitcoin to see ‘one more big thrust’ to $150K, ETH pressure builds: Trade Secrets</strong></em></p></div></div>

Hackers find new way to hide malware in Ethereum smart contracts

随著使用程式码库的攻击不断发展，威胁行为者找到了一种在以太坊智慧合约中传递恶意软体、命令和连结的新方法，以逃避安全扫描。
数位资产合规公司 ReversingLabs 的网路安全研究人员在 Node 套件管理器 (NPM) 套件储存库（大量 JavaScript 套件和程式库的集合）中发现了新的开源恶意软体。
ReversingLabs 研究员 Lucija Valentić 在周三的一篇部落格文章中表示，这些恶意软体包「采用了一种新颖且有创意的技术，可以在受感染的设备上加载恶意软体——以太坊区块链的智能合约」。
Valentić 解释说，7 月发布的两个软体包“colortoolsv2”和“mimelib2” “滥用智能合约来隐藏在受感染系统上安装下载恶意软体的恶意命令”。
为了避免安全扫描，这些软体包充当简单的下载器，而不是直接托管恶意链接，而是从智能合约中检索命令和控制伺服器位址。
安装后，这些软体包将查询区块链以获取下载第二阶段恶意软体的 URL，该恶意软体携带有效载荷或操作，这使得检测更加困难，因为区块链流量看起来是合法的。
NPM 软体套件「colortoolsv2」和「mimelib2」已发布在 GitHub 上。来源：ReversingLabs
新的攻击媒介
针对以太坊智能合约的恶意软体并不新鲜；今年早些时候，北韩附属骇客组织 Lazarus Group 就曾使用过这种恶意软体。
Valentić 表示：“新颖且不同的是，它使用以太坊智能合约来托管包含恶意命令的 URL，并下载第二阶段恶意软体。”
“这是我们以前从未见过的，它凸显了恶意行为者对开源存储库和开发人员的逃避检测策略的快速发展。”
精心策划的加密货币欺骗活动
这些恶意软体套件是一个更大规模、更复杂的社会工程和欺骗活动的一部分，主要透过 GitHub 进行操作。
威胁行为者创建了虚假的加密货币交易机器人存储库，透过伪造的提交、专门为监视存储库而创建的虚假用户帐户、模拟积极开发的多个维护者帐户以及看起来很专业的项目描述和文档，使其看起来非常值得信赖。
相关：加密货币用户因广告推送含有恶意软体的加密货币应用程式而受到警告
威胁行为者正不断演变
2024 年，安全研究人员记录了 23 起针对开源存储库的与加密相关的恶意活动，但 Valentić 总结道，这种最新的攻击媒介“表明针对存储库的攻击正在不断发展”，它将区块链技术与精心设计的社会工程学相结合，以绕过传统的检测方法。
这些攻击不仅发生在以太坊上。今年 4 月，一个伪装成Solana交易机器人的虚假 GitHub 储存库被用来传播伪装的恶意软体，窃取了加密钱包凭证。骇客还瞄准了“Bitcoinlib”，这是一个旨在简化比特币开发的开源 Python 库。
杂志：比特币将再次大幅上涨至 15 万美元， ETH压力加大：商业机密

<div><div><p>随著使用程式码库的攻击不断发展，威胁行为者找到了一种在以太坊智慧合约中传递恶意软体、命令和连结的新方法，以逃避安全扫描。</p><adv></adv><p>数位资产合规公司 ReversingLabs 的网路安全研究人员在 Node 套件管理器 (NPM) 套件储存库（大量 JavaScript 套件和程式库的集合）中发现了新的开源恶意软体。</p><adv></adv><p> ReversingLabs 研究员 Lucija Valentić 在周三的一篇部落格文章中表示，这些恶意软体包「采用了一种新颖且有创意的技术，可以在受感染的设备上加载恶意软体——以太坊区块链的智能合约」。</p><p> Valentić 解释说，7 月发布的两个软体包“colortoolsv2”和“mimelib2” “滥用智能合约来隐藏在受感染系统上安装下载恶意软体的恶意命令”。</p><p>为了避免安全扫描，这些软体包充当简单的下载器，而不是直接托管恶意链接，而是从智能合约中检索命令和控制伺服器位址。</p><p>安装后，这些软体包将查询区块链以获取下载第二阶段恶意软体的 URL，该恶意软体携带有效载荷或操作，这使得检测更加困难，因为区块链流量看起来是合法的。 </p><div><img src="https://cnews24.ru/uploads/cda/cda3b1244eb0b420f7fa38f47bf4ee925f9f9f88.jpg" title=""><div> <em>NPM 软体套件「colortoolsv2」和「mimelib2」已发布在 GitHub 上。资料来源：</em> <em>ReversingLabs</em></div></div><h2>新的攻击媒介</h2><p>针对以太坊智能合约的恶意软体并不新鲜；今年早些时候，北韩附属骇客组织 Lazarus Group 就曾使用过这种恶意软体。</p><p> Valentić 表示：“新颖且不同的是，它使用以太坊智能合约来托管包含恶意命令的 URL，并下载第二阶段恶意软体。”</p><blockquote> “这是我们以前从未见过的，它凸显了恶意行为者对开源存储库和开发人员的逃避检测策略的快速发展。”</blockquote><h2>精心策划的加密货币欺骗活动</h2><p>这些恶意软体套件是一个更大规模、更复杂的社会工程和欺骗活动的一部分，主要透过 GitHub 进行操作。</p><p>威胁行为者创建了虚假的加密货币交易机器人存储库，透过伪造的提交、专门为监视存储库而创建的虚假用户帐户、模拟积极开发的多个维护者帐户以及看起来很专业的项目描述和文档，使其看起来非常值得信赖。</p><p><em><strong>相关：</strong></em><em><strong>广告推送含有恶意软体的加密应用程序，警告加密用户</strong></em></p><h2>威胁行为者正不断演变</h2><p>2024 年，安全研究人员记录了 23 起针对开源存储库的与加密相关的恶意活动，但 Valentić 总结道，这种最新的攻击媒介“表明针对存储库的攻击正在不断发展”，它将区块链技术与精心设计的社会工程学相结合，以绕过传统的检测方法。</p><p>这些攻击不仅发生在以太坊上。今年 4 月，一个伪装成Solana交易机器人的虚假 GitHub 储存库被用来传播伪装的恶意软体，窃取了加密钱包凭证。骇客还瞄准了“Bitcoinlib”，这是一个旨在简化比特币开发的开源 Python 库。</p><p><em><strong>杂志：</strong></em><em><strong>比特币将再次大幅上涨至 15 万美元， ETH压力加大：商业机密</strong></em></p></div></div>

黑客找到在以太坊智能合约中隐藏恶意软件的新方法

今晚，全球金融市场的目光将聚焦于一个可能决定其未来数月命运的经济数据——美国非农就业报告（NFP）。在比特币价格于关键技术位摇摇欲坠，且宏大历史周期指针已悄然指向“顶部区域”的微妙时刻，这份报告犹如悬于市场头顶的达摩克利斯之剑，其数据的好坏，将可能成为压垮骆驼的最后一根稻草，或是点燃新一轮升势的火花。
市场正弥漫着一种复杂甚至有些扭曲的期待。在正常的经济逻辑中，强劲的就业数据意味着经济繁荣。然而在...

非农前瞻：三大剧本推演比特币今夜走势

作者：Wenser，Odaily 星球日报
---------------------------------------------------------------
9 月 2 日，现货黄金 日内涨超 1%，升穿 3510 美元 / 盎司，最高至 3512.27 美元 / 盎司，创历史新高；3 日早上，现货黄金 短线拉升逾 10 美元，最高报 3547 美元 / 盎司，再创新高。令人惊讶的是...

金价又起飞：5大黄金代币全解析

以下文章改编自 The Block 的新闻通讯《每日新闻》，该通讯于工作日 afternoons.Happy 星期五出版！美国 8 月份非农就业人数仅增加 22,000 人，失业率达到 4.3%，...