In May 2025, a number of RAR and EXE files associated with the domestic IP 158.247.250[.]251 were discovered. This IP was identified in past DNS records as being related to a phishing infrastructure associated with Naver, and there are query records related to Naver login URLs in VirusTotal.

caption - URL query records of 158.247.250[.]251

Among them, the relevant email files and the attached RAR and EXE files were reported from South Korea, and the email account that received the emails also belongs to a domain of an energy company in South Korea. Malware associated with this IP has been distributed under different file names in various countries besides South Korea. Analysis revealed that the distributed files were packed Formbook malware identified as being packed with PureCrypter.

While analyzing JavaScript files collected using VirusTotal's hunting feature, we noticed that a specific smart contract address appeared in multiple files. Further analysis revealed that this smart contract address is associated with the EtherHiding technique used in the ClearFake campaign.

The ClearFake campaign is a sophisticated attack that utilizes both the EtherHiding and ClickFix techniques to conceal and distribute malware to a wide range of users. EtherHiding involves hiding malicious content within Ethereum smart contracts to evade detection. ClickFix is a technique designed to lure users into clicking, thereby triggering the execution of malicious code.

This report details an analysis of the ClearFake campaign, which leverages both the EtherHiding and ClickFix techniques to distribute malware to a large number of users.

During analysis of malicious powershell script posted on X, a Github account that had been leveraged for attacks since March 2025 was discovered.

The malware contained a valid Github Personal Access Token (PAT) hardcoded by the attacker. We confirmed that this token was used to download malware from a private repository and upload information collected from victim systems.

The files present in the repository were identified as malware, decoy files, and information from infected systems, demonstrating that the attacker abused Github as attack infrastructure.

This report details the process of identifying attack infrastructure, analyzes the attack flow, and discusses its connection to the DPRK-nexus threat actor Kimsuky.