EtherHiding Malware Campaign Targets Developers With Fake Claude Code Tool
Attackers are using the EtherHiding technique to distribute malicious executables disguised as Claude Code, leveraging blockchain infrastructure for command-and-control operations.
EtherHiding is driving a new malware campaign that targets developers with a fake Claude Code CLI tool.
The attack starts when you download a malicious executable disguised as a legitimate developer tool. When executed, the software initiates a DLL sideloading chain by loading a malicious dynamic link library into a signed, legitimate process. This tactic lets the malware bypass basic security checks because the system treats the process as a trusted application.
Once active, the payload connects to a blockchain-based backend for command-and-control operations. Using blockchain infrastructure and decentralized networks to conceal instructions allows operators to keep communication channels persistent and difficult to sinkhole, while complicating traditional network traffic analysis.
Analysts identified specific indicators of compromise for this activity, including unique file signatures, installation file paths, and network patterns tied to blockchain interactions. You should verify the checksums and digital signatures of development tool downloads, especially those found via search engine advertisements. Security teams need to monitor environments for unauthorized DLL loading behaviors and unusual outbound connections to blockchain nodes or domains, using the provided indicators of compromise to audit logs.