Ethereum Security Alert: Swarm Software Compromised

Critical Security Alert Issued for EthereumETH-0.98% Ecosystem Users

Blockchain security firm SlowMist has issued an urgent security warning for everyone operating within the Ethereum ecosystem.

The warning comes after security analysts detected a complex supply chain attack targeting software associated with Ethersphere.

If you use tools linked to the Swarm network, you should check your setup right away to keep your system safe.

How Attackers Hijacked GitHub Accounts and Software Builds

SlowMist announced the urgent security breach in a recent post on the X social media platform.

Cybersecurity investigators revealed that hackers broke into official GitHub accounts tied to the project.

Once inside, the attackers took advantage of legitimate software release processes to deploy malicious updates to unsuspecting users.

Which Operating Systems and Projects Are Affected?

The attack poses potential risks to users running a wide range of operating systems.

Security experts warned that users on the following operating systems could be impacted:

• Windows
• macOS
• Linux

The compromised software belongs to Swarm, which is a decentralized storage network that forms part of the broader Ethereum ecosystem.

What Are the Major Risks to Your Wallet and Device?

Cybersecurity experts caution that running the compromised software builds exposes users to dangerous exploits.

The malicious code enables attackers to steal cryptocurrency wallet credentials and compromise private keys.

Furthermore, the malware can open permanent backdoors on affected systems, allowing remote access even after detection.

How Hackers Used Smart Contracts to Control the Malware

One of the most notable aspects of this attack is how hackers utilized Ethereum's own blockchain infrastructure.

SlowMist explained that the compromised software retrieves and executes malicious JavaScript code on target machines.

However, this is much more advanced than standard malware infections.

Attackers are leveraging an Ethereum smart contract as a decentralized command-and-control (C2) repository.

By using a smart contract as a command center, hackers can dynamically update the server addresses managing the malware without releasing new software updates.

Connection to Previous Sleepy Duck and Ether Duck Attacks

This specific smart contract is not new to security researchers.

Investigators noted that the same smart contract was previously associated with the notorious Sleepy Duck and Ether Duck malware campaigns.

Those earlier campaigns targeted software developers using malicious extensions hosted on the Open VSX marketplace.

This connection suggests the new breach could be part of a larger ongoing campaign targeting crypto developers and ecosystem users.

Independent Findings by Socket and SafeDep

Other cybersecurity research teams also discovered malicious activity linked to the breach.

Independent security researchers from Socket and SafeDep identified malware designed specifically to steal Swarm wallet files.

Their research confirmed that the code attempts to deploy persistent remote access tools across compromised machines.

Urgent Steps to Protect Yourself and Update Software

SlowMist has provided clear instructions for users to secure their systems immediately.

If you installed the affected package, uninstall it immediately and roll back to the clean version 13.2.0.

Users running Swarm Desktop v0.56.2 are strongly advised to update to the clean v0.56.3 release as soon as possible.

Always verify download sources and use clean repositories when updating decentralized storage software.