Cybersecurity researchers have identified an advanced evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals C2 server IP addresses within fabricated Ethereum transfer destinations. Specifically: bianira-ui (109 downloads), uploaded by "npmuser1101"; fluid-type-ui (587 downloads), uploaded by "npmuser3002". EtherHiding was first disclosed by Guardio Labs in October 2023 as a sophisticated method of hiding malicious code within smart contracts on public blockchains like Binance Smart Chain (BSC) and Ethereum.
This approach circumvents one of the primary limitations of EtherHiding, which necessitates a fixed and publicly known destination address—addressable by defenders through new transactions containing the payload, C2 IP address, or malicious script.
The entire sequence of actions on a victim machine is detailed below: - Look up a hard-coded attacker wallet ("0xa322e5f3d311d3080e6f0121063e9adc2490ef1a") - Find its most recent outbound transaction - Read that transaction's destination address - Decode a C2 IP address directly out of the address bytes by converting the first four bytes from their hexadecimal representation to their number equivalent - Connect to that IP address ("166.88.134[. ]62") An examination of the wallet transactions reveals that the destination "To" address for each transaction is identical: "0xa658863ea658863e68656c6c6f6970626f742121." While "a658863e" becomes "166.88.134[.
]62," the trailing bytes "68656c6c6f6970626f742121" represent the ASCII string "helloipbot!!." As of writing, 68 transactions have taken place since July 27, 2026, just one day before the packages were published.
