Cybersecurity researchers have identified NullReceiver, a sophisticated evolution of the EtherHiding technique that conceals malicious command-and-control server addresses within empty Ethereum blockchain transactions to evade detection.

Key Points

• NullReceiver encodes command-and-control IP addresses directly into the destination bytes of zero-value, zero-data Ethereum transfers.
• The technique was discovered in several trojanized npm packages, including "bianira-ui," "fluid-type-ui," and various Tailwind-related libraries.
• Unlike previous methods, NullReceiver avoids using smart contracts or transaction calldata, making the malicious activity significantly cheaper and harder to fingerprint.
• Researchers linked the campaign to North Korean threat actors, who have used similar infrastructure in broader efforts to compromise developer machines.
• Over 20 additional compromised packages across npm, Go, and PHP ecosystems have been identified as part of the related PolinRider campaign.

Why it Matters

This development highlights a significant shift in how threat actors leverage blockchain technology to maintain stealthy, resilient communication channels with infected systems. By eliminating fixed, watchable transaction patterns, attackers are making it increasingly difficult for security teams to detect and block malicious infrastructure.