Ethereum Alert: Hackers Hijack Swarm Software, Use Smart Contract as Malware Command Center

SlowMist dropped an urgent security alert for Ethereum users after two software packages tied to Ethersphere were compromised. According to the blockchain security firm, attackers broke into GitHub accounts and rode legitimate software release processes to push out malicious builds. The poisoned releases target Windows, macOS and Linux.

The affected code belongs to Swarm, a decentralized storage network sitting inside the wider Ethereum ecosystem. Researchers say the malware pulls down and executes malicious JavaScript, a setup capable of lifting cryptocurrency wallet credentials, snatching private keys and planting permanent backdoors on infected machines.

Here's the nasty part: the attackers are using an Ethereum smart contract as a decentralized command-and-control configuration repository. That means they can swap out the server addresses steering the malware without ever redeploying it. The same smart contract showed up in the SleepyDuck and EtherDuck malware campaigns, which went after developers through malicious extensions on the Open VSX marketplace — a hint that this is part of a bigger push against crypto developers and users.

Independent researchers at Socket and SafeDep also flagged the malware, finding code built to steal Swarm wallet files and install persistent remote access tools. SlowMist's fix is blunt: uninstall the affected package right away and roll back to the clean version 13.2.0. Swarm Desktop users on v0.56.2 should update to the clean v0.56.3 release.