Malicious Blockchain Contracts: The EtherHiding Tracker

EtherHiding turns blockchain smart contracts into resilient delivery points for malicious code and infrastructure. A loader embedded in a compromised website can read instructions from a contract and execute them in the visitor’s browser. Attackers can therefore replace domains, scripts, or payloads without modifying the compromised website again—allowing campaigns to evade domain-based blocking and remain active longer.

This technique is particularly relevant to client-side attacks such as ClickFix and Magecart. The same contract-based delivery chain can redirect visitors to fraudulent instructions, inject payment-skimming code, or load an entirely new attack. The table below documents contracts observed in malicious activity and the content retrieved from them. Because contract data may change, each entry represents a snapshot taken on the stated date.