Cybersecurity researchers have uncovered a new blockchain-based technique that allows attackers to hide malware command-and-control (C2) server addresses in a way that is even more difficult to detect than previous methods.
The technique, dubbed NullReceiver, was discovered in two malicious npm packages and is believed to be linked to North Korean threat actors. Researchers say the approach represents a significant evolution of the earlier EtherHiding method, making malware infrastructure harder to identify and disrupt.
Malicious npm Packages Removed
The campaign involved two compromised JavaScript packages published on the npm registry:
- bianira-ui
- fluid-type-ui
Although both packages have since been removed, they were downloaded hundreds of times after appearing on July 28, 2026.
According to researchers, the packages appeared legitimate but secretly contained code designed to locate and communicate with attacker-controlled infrastructure.
From EtherHiding to NullReceiver
The newly discovered technique builds on EtherHiding, a blockchain abuse method first documented in 2023.
EtherHiding worked by storing malicious information inside Ethereum or BNB Smart Chain transactions or smart contracts, allowing attackers to hide command-and-control information on decentralized networks that are difficult to take down.
NullReceiver takes the concept a step further.
Instead of embedding malicious data in transaction payloads or smart contracts, the attackers hide the command server’s IP address inside the recipient address of an otherwise empty Ethereum transaction.
The transaction carries:
- No cryptocurrency transfer
- No smart contract interaction
- No transaction data
- No obvious malicious content
To anyone examining the blockchain, the transfer appears completely ordinary.
How the Technique Works
Once installed on a victim’s system, the malicious npm package performs several automated steps:
- It queries a hardcoded Ethereum wallet controlled by the attackers.
- It retrieves the wallet’s latest outgoing transaction.
- It reads the destination wallet address.
- It converts part of that address into an IP address.
- It connects directly to the decoded command-and-control server.
Researchers found that one encoded wallet address translated into the IP address:
166.88.134.62
The remaining characters within the address decoded to the text:
“helloipbot!!”
This hidden encoding allows malware to discover its control server without exposing it through traditional indicators.
Why NullReceiver Is Harder to Detect
Researchers say the new technique removes several weaknesses found in EtherHiding.
Traditional EtherHiding relied on a known blockchain address or smart contract where defenders could monitor new malicious transactions.
NullReceiver eliminates that predictable target.
Instead, every transaction uses a unique destination address that exists only long enough to encode the hidden server information.
Because the destination changes constantly, security teams have no fixed blockchain address to monitor.
The technique also avoids leaving suspicious data inside transaction payloads, reducing the number of indicators available for threat hunters.
Lower Cost, Lower Visibility
Another advantage for attackers is cost.
Ethereum transaction data increases transaction fees because every byte stored on-chain consumes gas.
Since NullReceiver uses completely empty transactions, it avoids those additional costs while blending in with millions of normal blockchain transfers.
Researchers describe the transactions as among the least conspicuous transaction types currently possible on Ethereum.
Links to North Korean Cyber Operations
Security researchers believe the campaign is connected to North Korean cyber operators, although attribution remains based on technical evidence rather than public government confirmation.
The discovery follows previous reports linking North Korean groups to EtherHiding and the long-running Contagious Interview campaign.
In that operation, attackers posed as recruiters on professional networking platforms such as LinkedIn, offering fake job opportunities to software developers before convincing them to install malware disguised as coding assessments.
The appearance of NullReceiver suggests those actors continue to refine their malware delivery and command-and-control techniques.
Growing Abuse of Blockchain Technology
The discovery highlights how blockchain technology is increasingly being misused beyond cryptocurrency theft.
Rather than using blockchain to move stolen funds, attackers are leveraging public decentralized networks to store configuration data, hide infrastructure, and improve the resilience of malware operations.
Because blockchain records are distributed across thousands of nodes worldwide, removing malicious information is far more difficult than shutting down a traditional command server.
Security Recommendations
Security professionals recommend several steps to reduce exposure:
- Avoid installing npm packages from unknown or unverified publishers.
- Review package maintainers and download history before installation.
- Use software composition analysis (SCA) tools to detect malicious dependencies.
- Monitor outbound network connections from development environments.
- Keep threat intelligence feeds updated to identify newly discovered indicators of compromise.
The emergence of NullReceiver demonstrates that attackers continue to innovate by combining open-source software ecosystems with blockchain infrastructure, creating increasingly stealthy methods for maintaining malware communications while avoiding detection.