EtherHiding moves a website loader's next address into a smart contract.

EtherHiding is JavaScript on an infected website that reads code or an address from a smart contract. The loader sends a read-only eth_call through a public blockchain RPC service, decodes the reply and loads what the contract names.

infected website
  -> public blockchain RPC service
  -> eth_call to a smart contract
  -> contract returns code or an address
  -> visitor's browser loads the next script

The contract controls every infected copy

The contract address and function selector are built into the injected loader. The operator can replace the value stored in the contract without editing the infected sites again. Every copy that reads that contract follows the new value on its next visit.

Guardio Labs named the technique EtherHiding in October 2023 after finding ClearFake loaders on compromised WordPress sites reading malicious JavaScript from BNB Smart Chain (Guardio Labs). The eth_call read creates no transaction on the chain and costs the reader no gas.

That separation makes takedown harder. Removing the current script host interrupts one route, but the injected code and contract remain.

Chains and kits

The loaders we track read Polygon, BNB Smart Chain mainnet, BNB Smart Chain testnet, Ethereum mainnet, Ethereum Sepolia and Base. They carry several public RPC endpoints and try another when one fails.

The ClickFix kits with their own pages here use several versions of the pattern:

• BW panel reads its panel address from Polygon.
• DoubleDonut reads a whole script from BNB Smart Chain testnet.
• OverlayWar decodes staging hosts stored on Polygon.
• GzipGnaw decrypts and decompresses a stage from Sepolia.
• ChainBite walks through several BNB Smart Chain testnet contracts.
• LenAI reads controller addresses from Polygon and Sepolia. One build reads a block number from a BNB Smart Chain testnet contract and runs the lure stored in that block's transaction log.
• NoChain stores scripts and a lure page in a contract on Base.
• CLEARSHORT uses router, logic and storage contracts on BNB Smart Chain.
• CookieDam has a build that reads its overlay host from Ethereum mainnet.

HexMage uses the same staging idea for a payment-card skimmer. Its loader asks a Sepolia contract where to find the per-site skimmer script. BaseTask decrypts a controller URL read from a Base contract, then sends AES-GCM-encrypted get_bundle and get_resource requests. The returned task lists select JavaScript to cache in IndexedDB or inject through Blob URLs and inline script elements.

SuperPixel, another card skimmer, reads its collection host from an Ethereum mainnet contract. FileDrop runs fake software download sites: copies of BleachBit, FileZilla, Notepad++ and other free tools whose Download buttons read the download server from a Base contract and hand the visitor a ticketed ZIP to run.

Contract history

We read 189 registered contracts every day. The EtherHiding contract tracker shows each contract's family, chain, address, current destination and destination history. The tracker lists the first and last date for every destination we decoded.

What we see across infected sites

Month	New sites
September	22,271
October	13,936
November so far	3,292

83% of the EtherHiding sites captured since 25 September run WordPress. Of the 19,172 sites recaptured at least 25 days after their first match, 15,840 still served EtherHiding code (83%).

Checking a site

Open the public page while logged out and watch its network requests. On a site with no blockchain feature, trace:

• JSON-RPC requests whose method is eth_call
• requests to public Polygon, BNB Smart Chain, Sepolia or Base RPC services
• a contract address and function selector embedded in page JavaScript
• code that strips ABI padding, decodes Base64, decrypts a string or creates a script element from the reply

Then find the script in the page source, theme, plugin or cached JavaScript that created the call. Remove the injection and the access used to place it, then rotate site and hosting credentials. Blocking the current destination leaves the loader in place.