Threat actors have found a new way to deliver malicious software, commands, and links inside Ethereum smart contracts to evade security scans as attacks using code repositories evolve.
Cybersecurity researchers at digital asset compliance firm ReversingLabs have found new pieces of open-source malware discovered on the Node Package Manager (NPM) package repository, a large collection of JavaScript packages and libraries.
The malware packages “employ a novel and creative technique for loading malware on compromised devices — smart contracts for the Ethereum blockchain,” ReversingLabs researcher Lucija Valentić said in a blog post on Wednesday.
The two packages, “colortoolsv2” and “mimelib2,” published in July, “abused smart contracts to conceal malicious commands that installed downloader malware on compromised systems,” explained Valentić.
To avoid security scans, the packages functioned as simple downloaders and instead of directly hosting malicious links, they retrieved command and control server addresses from the smart contracts.
When installed, the packages would query the blockchain to fetch URLs for downloading second-stage malware, which carries the payload or action, making detection more difficult since blockchain traffic appears legitimate.
NPM packages ‘colortoolsv2’ and ‘mimelib2’ on GitHub. Source: ReversingLabs
A new attack vector
Malware targeting Ethereum smart contracts is not new; it was used earlier this year by the North Korean-affiliated hacking collective the Lazarus Group.
“What is new and different is the use of Ethereum smart contracts to host the URLs where malicious commands are located, downloading the second-stage malware,” said Valentić, who added:
“That’s something we haven’t seen previously, and it highlights the fast evolution of detection evasion strategies by malicious actors who are trolling open source repositories and developers.”
An elaborate crypto deception campaign
The malware packages were part of a larger, elaborate social engineering and deception campaign primarily operating through GitHub.
Threat actors created fake cryptocurrency trading bot repositories designed to look highly trustworthy through fabricated commits, fake user accounts created specifically to watch repositories, multiple maintainer accounts to simulate active development, and professional-looking project descriptions and documentation.
Related: Crypto users warned as ads push malware-laden crypto apps
Threat actors are evolving
In 2024, security researchers documented 23 crypto-related malicious campaigns on open-source repositories, but this latest attack vector “shows that attacks on repositories are evolving,” combining blockchain technology with elaborate social engineering to bypass traditional detection methods, Valentić concluded.
These attacks are not only executed on Ethereum. In April, a fake GitHub repository posing as a Solana trading bot was used to distribute obscured malware that stole crypto wallet credentials. Hackers have also targeted “Bitcoinlib,” an open-source Python library designed to make Bitcoin development easier.
Magazine: Bitcoin to see ‘one more big thrust’ to $150K, ETH pressure builds: Trade Secrets

<div><div><p>Threat actors have found a new way to deliver malicious software, commands, and links inside Ethereum smart contracts to evade security scans as attacks using code repositories evolve. </p><adv></adv><p>Cybersecurity researchers at digital asset compliance firm ReversingLabs have found new pieces of open-source malware discovered on the Node Package Manager (NPM) package repository, a large collection of JavaScript packages and libraries.</p><adv></adv><p>The malware packages “employ a novel and creative technique for loading malware on compromised devices — smart contracts for the Ethereum blockchain,” ReversingLabs researcher Lucija Valentić said in a blog post on Wednesday.</p><p>The two packages, “colortoolsv2” and “mimelib2,” published in July, “abused smart contracts to conceal malicious commands that installed downloader malware on compromised systems,” explained Valentić. </p><p>To avoid security scans, the packages functioned as simple downloaders and instead of directly hosting malicious links, they retrieved command and control server addresses from the smart contracts. </p><p>When installed, the packages would query the blockchain to fetch URLs for downloading second-stage malware, which carries the payload or action, making detection more difficult since blockchain traffic appears legitimate.</p><div><img src="https://cnews24.ru/uploads/cda/cda3b1244eb0b420f7fa38f47bf4ee925f9f9f88.jpg" title=""><div><em>NPM packages ‘colortoolsv2’ and ‘mimelib2’ on GitHub. Source: </em><em>ReversingLabs</em></div></div><h2>A new attack vector </h2><p>Malware targeting Ethereum smart contracts is not new; it was used earlier this year by the North Korean-affiliated hacking collective the Lazarus Group.</p><p>“What is new and different is the use of Ethereum smart contracts to host the URLs where malicious commands are located, downloading the second-stage malware,” said Valentić, who added: </p><blockquote>“That’s something we haven’t seen previously, and it highlights the fast evolution of detection evasion strategies by malicious actors who are trolling open source repositories and developers.”</blockquote><h2>An elaborate crypto deception campaign</h2><p>The malware packages were part of a larger, elaborate social engineering and deception campaign primarily operating through GitHub. </p><p>Threat actors created fake cryptocurrency trading bot repositories designed to look highly trustworthy through fabricated commits, fake user accounts created specifically to watch repositories, multiple maintainer accounts to simulate active development, and professional-looking project descriptions and documentation.</p><p><em><strong>Related: </strong></em><em><strong>Crypto users warned as ads push malware-laden crypto apps</strong></em></p><h2>Threat actors are evolving </h2><p>In 2024, security researchers documented 23 crypto-related malicious campaigns on open-source repositories, but this latest attack vector “shows that attacks on repositories are evolving,” combining blockchain technology with elaborate social engineering to bypass traditional detection methods, Valentić concluded. </p><p>These attacks are not only executed on Ethereum. In April, a fake GitHub repository posing as a Solana trading bot was used to distribute obscured malware that stole crypto wallet credentials. Hackers have also targeted “Bitcoinlib,” an open-source Python library designed to make Bitcoin development easier.</p><p><em><strong>Magazine: </strong></em><em><strong>Bitcoin to see ‘one more big thrust’ to $150K, ETH pressure builds: Trade Secrets</strong></em></p></div></div>

Hackers find new way to hide malware in Ethereum smart contracts

隨著使用程式碼庫的攻擊不斷發展，威脅行為者找到了一種在以太坊智慧合約中傳遞惡意軟體、命令和連結的新方法，以逃避安全掃描。
數位資產合規公司 ReversingLabs 的網路安全研究人員在 Node 套件管理器 (NPM) 套件儲存庫（大量 JavaScript 套件和程式庫的集合）中發現了新的開源惡意軟體。
ReversingLabs 研究員 Lucija Valentić 在周三的一篇部落格文章中表示，這些惡意軟體包「採用了一種新穎且有創意的技術，可以在受感染的設備上加載惡意軟體——以太坊區塊鏈的智能合約」。
Valentić 解釋說，7 月發布的兩個軟體包“colortoolsv2”和“mimelib2” “濫用智能合約來隱藏在受感染系統上安裝下載惡意軟體的惡意命令”。
為了避免安全掃描，這些軟體包充當簡單的下載器，而不是直接託管惡意鏈接，而是從智能合約中檢索命令和控制伺服器位址。
安裝後，這些軟體包將查詢區塊鏈以獲取下載第二階段惡意軟體的 URL，該惡意軟體攜帶有效載荷或操作，這使得檢測更加困難，因為區塊鏈流量看起來是合法的。
NPM 軟體套件「colortoolsv2」和「mimelib2」已發佈在 GitHub 上。來源：ReversingLabs
新的攻擊媒介
針對以太坊智能合約的惡意軟體並不新鮮；今年早些時候，北韓附屬駭客組織 Lazarus Group 就曾使用過這種惡意軟體。
Valentić 表示：“新穎且不同的是，它使用以太坊智能合約來託管包含惡意命令的 URL，並下載第二階段惡意軟體。”
“這是我們以前從未見過的，它凸顯了惡意行為者對開源存儲庫和開發人員的逃避檢測策略的快速發展。”
精心策劃的加密貨幣欺騙活動
這些惡意軟體套件是一個更大規模、更複雜的社會工程和欺騙活動的一部分，主要透過 GitHub 進行操作。
威脅行為者創建了虛假的加密貨幣交易機器人存儲庫，透過偽造的提交、專門為監視存儲庫而創建的虛假用戶帳戶、模擬積極開發的多個維護者帳戶以及看起來很專業的項目描述和文檔，使其看起來非常值得信賴。
相關：加密貨幣用戶因廣告推送含有惡意軟體的加密貨幣應用程式而受到警告
威脅行為者正不斷演變
2024 年，安全研究人員記錄了 23 起針對開源存儲庫的與加密相關的惡意活動，但 Valentić 總結道，這種最新的攻擊媒介“表明針對存儲庫的攻擊正在不斷發展”，它將區塊鏈技術與精心設計的社會工程學相結合，以繞過傳統的檢測方法。
這些攻擊不僅發生在以太坊上。今年 4 月，一個偽裝成Solana交易機器人的虛假 GitHub 儲存庫被用來傳播偽裝的惡意軟體，竊取了加密錢包憑證。駭客還瞄準了“Bitcoinlib”，這是一個旨在簡化比特幣開發的開源 Python 庫。
雜誌：比特幣將再次大幅上漲至 15 萬美元， ETH壓力加大：商業機密

<div><div><p>隨著使用程式碼庫的攻擊不斷發展，威脅行為者找到了一種在以太坊智慧合約中傳遞惡意軟體、命令和連結的新方法，以逃避安全掃描。</p><adv></adv><p>數位資產合規公司 ReversingLabs 的網路安全研究人員在 Node 套件管理器 (NPM) 套件儲存庫（大量 JavaScript 套件和程式庫的集合）中發現了新的開源惡意軟體。</p><adv></adv><p> ReversingLabs 研究員 Lucija Valentić 在周三的一篇部落格文章中表示，這些惡意軟體包「採用了一種新穎且有創意的技術，可以在受感染的設備上加載惡意軟體——以太坊區塊鏈的智能合約」。</p><p> Valentić 解釋說，7 月發布的兩個軟體包“colortoolsv2”和“mimelib2” “濫用智能合約來隱藏在受感染系統上安裝下載惡意軟體的惡意命令”。</p><p>為了避免安全掃描，這些軟體包充當簡單的下載器，而不是直接託管惡意鏈接，而是從智能合約中檢索命令和控制伺服器位址。</p><p>安裝後，這些軟體包將查詢區塊鏈以獲取下載第二階段惡意軟體的 URL，該惡意軟體攜帶有效載荷或操作，這使得檢測更加困難，因為區塊鏈流量看起來是合法的。 </p><div><img src="https://cnews24.ru/uploads/cda/cda3b1244eb0b420f7fa38f47bf4ee925f9f9f88.jpg" title=""><div> <em>NPM 軟體套件「colortoolsv2」和「mimelib2」已發佈在 GitHub 上。資料來源：</em> <em>ReversingLabs</em></div></div><h2>新的攻擊媒介</h2><p>針對以太坊智能合約的惡意軟體並不新鮮；今年早些時候，北韓附屬駭客組織 Lazarus Group 就曾使用過這種惡意軟體。</p><p> Valentić 表示：“新穎且不同的是，它使用以太坊智能合約來託管包含惡意命令的 URL，並下載第二階段惡意軟體。”</p><blockquote> “這是我們以前從未見過的，它凸顯了惡意行為者對開源存儲庫和開發人員的逃避檢測策略的快速發展。”</blockquote><h2>精心策劃的加密貨幣欺騙活動</h2><p>這些惡意軟體套件是一個更大規模、更複雜的社會工程和欺騙活動的一部分，主要透過 GitHub 進行操作。</p><p>威脅行為者創建了虛假的加密貨幣交易機器人存儲庫，透過偽造的提交、專門為監視存儲庫而創建的虛假用戶帳戶、模擬積極開發的多個維護者帳戶以及看起來很專業的項目描述和文檔，使其看起來非常值得信賴。</p><p><em><strong>相關：</strong></em><em><strong>廣告推送含有惡意軟體的加密應用程序，警告加密用戶</strong></em></p><h2>威脅行為者正不斷演變</h2><p>2024 年，安全研究人員記錄了 23 起針對開源存儲庫的與加密相關的惡意活動，但 Valentić 總結道，這種最新的攻擊媒介“表明針對存儲庫的攻擊正在不斷發展”，它將區塊鏈技術與精心設計的社會工程學相結合，以繞過傳統的檢測方法。</p><p>這些攻擊不僅發生在以太坊上。今年 4 月，一個偽裝成Solana交易機器人的虛假 GitHub 儲存庫被用來傳播偽裝的惡意軟體，竊取了加密錢包憑證。駭客還瞄準了“Bitcoinlib”，這是一個旨在簡化比特幣開發的開源 Python 庫。</p><p><em><strong>雜誌：</strong></em><em><strong>比特幣將再次大幅上漲至 15 萬美元， ETH壓力加大：商業機密</strong></em></p></div></div>

黑客找到在以太坊智能合約中隱藏惡意軟件的新方法

在 Chainalysis 數資產採用報告中出現的第五年，越南保持了前五名國家之一的倉位。
越南繼續保持前五名的倉位，其中...

越南繼續保持加密採用率最高的五個國家之倉位…

隨著實體交易卡市場達到歷史最高水平，加密貨幣原生者紛紛湧入 CARDS，收藏家代幣 Crypt.CARDS 在過去 24 小時內上漲了 286%，自昨天以來上漲了 10 倍以上……

隨著交易者湧向代幣化寶可夢卡牌平臺，CARDS 代幣價格飆升

今日，美國比特幣公司 American Bitcoin Corp（ABTC） 在納斯達克正式掛牌交易。由Eric Trump擔任聯合創始人兼首席戰略官、與特朗普家族關係密切的這家公司，上市首日就上演了一出驚心動魄的“資本過山車”。
[1756934783856708.png]
ABTC的Pump & Dump
市場數據顯示，ABTC 開盤盤中最高曾暴漲逾 110%，但最終收漲約 17%。
[175...