# EtherHiding Delivered as Authored Post Content via WordPress XML-RPC

**A known blockchain C2 technique arriving through an intrusion path that does not require site compromise.**

Point Arena Cyber Security | Honeypot capture, 2026-09-20 | TLP:CLEAR

| | | | |
|---|---|---|---|
| **Observed** | 2026-09-20 18:40:39 UTC | **Source** | 192.42.116.104 (Tor exit, AS215125, NL) |
| **Vector** | POST /xmlrpc.php, metaWeblog.newPost | **Body** | 191,981 chars |
| **Technique** | EtherHiding (T1102, T1608) | **Chain** | Ethereum mainnet |
| **Outcome** | Captured by deception host. No live site affected. | **Confidence** | High on mechanics, moderate on novelty |

---

## What is new here, and what is not

EtherHiding is well documented. So is the fake CAPTCHA lure, the multi-endpoint RPC fallback list, attacker-operated RPC gateways, and `String.fromCharCode()` cloaking. None of that is presented here as a discovery. Published reporting covers deployments on BNB Smart Chain mainnet and testnet, Polygon mainnet, and Base mainnet.

Two things in this sample do not appear in the public reporting reviewed for this note.

### 1. The delivery path involves no site compromise

Every public account of EtherHiding on WordPress begins with the site being compromised, then the loader being written into plugin files, theme files, a must-use plugin, a malicious Service Worker, or the database. This sample writes no files at all. The actor authenticated to XML-RPC with a guessed credential pair and published a post. The loader lives in post content, as legitimately authored, published content owned by a real account.

The consequences are what make it worth writing down:

- No backdoor, no webshell, no modified file. File integrity monitoring and plugin scanners have nothing to find.
- No persistence mechanism. Access is the credential, and the credential is guessable by formula, so persistence is unnecessary.
- The reach is every WordPress site with one weak account and XML-RPC reachable, which is a far larger population than sites with an exploitable plugin.
- Remediation is deleting a post and rotating a password, not rebuilding a host. Most operators will never know it happened.

### 2. The chain is Ethereum mainnet

Reviewed reporting places these contracts on BNB Smart Chain, Polygon, or Base, all chosen because storage updates cost cents or nothing. This contract is on Ethereum mainnet, the most expensive option available. That is either an operator willing to pay for the most reliable public RPC ecosystem, or a different operator entirely. Stated at moderate confidence: this is an absence of evidence across a literature review, not a negative result from a dataset.

---

## Execution chain

| Stage | Mechanism | Why it matters |
|---|---|---|
| **1. Access** | XML-RPC authentication with credentials derived from the hostname: `<sitename>` and `<sitename>777`. One guess per target, not a brute force. | The generation pattern is a more durable botnet fingerprint than the source IP, which rotates through Tor exits. |
| **2. Publish** | `metaWeblog.newPost`, post_status `publish`, category and tag both `Trainers`, titled as a cracked game repack. Body is 93.2% one inline base64 PNG. | SEO bait aimed at piracy search traffic. The image bulk also pushes indicators past naive truncation limits. |
| **3. Smuggle** | Zero script tags. JavaScript rides an `onload` attribute on a 42-byte 1x1 transparent GIF with `display:none`. | Forced by stage 1. Without file access the actor cannot place a script tag, so the handler attribute is the only route. |
| **4. Gate** | In-page canvas CAPTCHA, five characters, drawn client side. Nothing is fetched until the visitor types the right value. | Anti-analysis. Crawlers, sandboxes and site scanners never reach the network stage. |
| **5. Fetch** | `eth_call` to a fixed contract, tried across 25 public RPC endpoints shuffled by `sort(() => Math.random() - 0.5)`, 2000 ms timeout each, first success wins. | No payload URL exists anywhere in the page. There is no domain to sinkhole and no contract that can be deleted. |
| **6. Render** | Return value sliced at offset 130 past the ABI header, decoded hex pair by hex pair into text, written via `innerHTML` with `%name%` replaced by `f8aefb5e_desert_deluxe`. | Final stage content was not retrievable from the capture. Published variants of this family terminate in ClickFix; unverified here. |

---

## Obfuscation, and why it defeated first-pass extraction

Two different schemes are layered, and they are not equally effective. The RPC endpoints use split string literals with hex-escaped separators, which a concatenation collapse resolves:

```
'http'+'s\x3A\x2F\x2F'+'1r'+'pc.'+'io\x2Feth'
```

The two indicators that actually matter use character-code arithmetic instead, each byte its own expression:

```
to:   String.fromCharCode((8+13+27),(101+19),(36+12), ... )
      -> 0x08fdd25b78df4e941536953be1300455e3881881

data: String.fromCharCode((40+8),(87+33),(87+9+5), ... )
      -> 0xea879634
```

The result is a payload that looks forthcoming. It hands an analyst 25 URLs while the contract address and the function selector, the only two values that identify the operator, stay invisible to any flat regex scan. An extractor that resolves concatenation but not character codes produces a confident, complete-looking indicator set with the C2 missing from it.

---

## Indicators

| Type | Value | Note |
|---|---|---|
| Contract | `0x08fdd25b78df4e941536953be1300455e3881881` | Ethereum mainnet. Payload store. |
| Selector | `0xea879634` | Retrieval function. |
| RPC host | `one.valve.city/rpc/vk_demo/evm/1` | Only non-public endpoint among 25. Path shape suggests a per-tenant gateway with an unchanged demo key. |
| Credentials | `<sitename> : <sitename>777` | Derived per target. Durable fingerprint. |
| Campaign tag | `f8aefb5e_desert_deluxe` | Substituted into the retrieved stage. |
| String | `Error: Conne_tion failed.` | Misspelling in the builder's failure path. Useful hunting string. |
| Decoy | `ec7baf7a5260ba05ffaf5bdae6fe3f4b` | Rendered on the page as a repack checksum. **Not a malware hash.** Listed so it is not mistakenly enriched. |
| Source | `192.42.116.0/22`, AS215125 | Tor exit range. Low blocking value. |

---

## Detection and hardening

The contract cannot be taken down and the RPC providers are legitimate infrastructure, so detection has to sit on behaviour and on the intrusion path rather than on hosting.

### Site operators

- Disable XML-RPC unless a client genuinely needs it. If it is needed, rate limit it and alert on authentication failures against `/xmlrpc.php`.
- Audit published posts for `onload`, `onerror` and `onclick` attributes in post content. A hidden 1x1 image carrying an event handler has no legitimate use in an article.
- Reject any account password derived from the site hostname. This campaign needs exactly one guess.
- Review posts by publication route, not just by content. A post created through XML-RPC on a site whose editors all use the web UI is worth a look on that basis alone.

### Network and endpoint

- Alert on browser-originated JSON-RPC `eth_call` POSTs from ordinary content pages. A news article or a download page has no reason to talk to an Ethereum node.
- Treat a page requesting several unrelated public RPC providers in quick succession as the signal. One is plausible, a shuffled list of twenty-five is a fallback chain.
- Enforce clipboard write restrictions in managed browsers. This family generally terminates in ClickFix, which depends on the victim pasting a command.

### Analysts

- Resolve character-code construction before extracting indicators. A payload can look fully enumerated while the C2 stays hidden behind arithmetic.
- Extract indicators from the complete body before any truncation limit applies. In this sample a 20,000 character cut consumed its entire budget on inline image data and preserved zero URLs.

---

## Provenance and limits

The sample was captured by a Cloudflare Worker deception host operated by Point Arena Cyber Security. Nothing was executed. All analysis was static: structural parsing, base64 decoding with magic byte identification, and arithmetic evaluation with a parser restricted to digits, addition, subtraction, multiplication and parentheses. The contract was never queried and no endpoint in the payload was contacted, so the final stage is undetermined. The novelty assessment rests on a review of public reporting and may be superseded by material not surfaced; the mechanics stated above are read directly from the artifact and do not depend on it.

---

Point Arena Cyber Security | [pointarenacybersecurity.dev](https://pointarenacybersecurity.dev) | Published TLP:CLEAR. Indicators may be redistributed freely.