The ClearFake malware campaign hides its malicious payloads inside smart contracts on a public blockchain using the EtherHiding technique, making it nearly impossible to take down through conventional means. These attacks are actively infecting consumers and employees across a wide range of organizations and sectors, ultimately installing credential stealers that can lead to infiltration and major damage.
In this session, LevelBlue SpiderLabs VP of Security Research Ziv Mador, and Senior Security Research Manager Pawel Knapczyk turn the attacker’s own infrastructure against them, using that same on-chain data to identify real victims of an active campaign.
You'll learn:
How ClearFake uses EtherHiding to distribute malicious payloads through the blockchain, largely unnoticed
How the actors keep operational costs low by using the testnet of the Binance network
How SpiderLabs used the attacker’s own on-chain data to identify real victims of an active campaign
What happens after infection: credential theft and the path to broader organizational damage
