UNC5342 EtherHiding (JADESNOW / INVISIBLEFERRET) in Contagious Interview campaign

Google Threat Intelligence Group (GTIG) / Google Cloud

Since February 2025, GTIG has tracked UNC5342 incorporating EtherHiding into an ongoing social engineering campaign, dubbed Contagious Interview by Palo Alto Networks. In this campaign, the actor uses JADESNOW malware to deploy a JavaScript variant of INVISIBLEFERRET, which has led to numerous cryptocurrency heists.