BaseTask EtherHiding kit

A Base contract supplies the controller

BaseTask arrives as page JavaScript or a loaded script. It screens the browser for automation before contacting its controller: checks include navigator.webdriver, headless user-agent strings, canvas output, WebGL renderers and window dimensions.

The loader sends eth_call through public Base RPC services to the contract built into its code. It extracts an encrypted string from the reply and decrypts it with AES-GCM, using an embedded key. The result is the controller URL, which it caches in local storage.

Encrypted requests retrieve executable scripts

The first controller request carries action:"get_bundle" and a permit value. BaseTask encrypts the request with AES-GCM and posts the encoded ciphertext as text/plain. The reply supplies execute and preload lists.

Named resources are fetched with action:"get_resource" and cached in IndexedDB. A preload entry can ask the loader to execute the cached resource immediately. The execute list supplies JavaScript directly, and the final script receives the controller URL as an argument.

BaseTask creates a JavaScript Blob, assigns its object URL to a script element and appends it to the document. Its fallback inserts the returned source as inline script text.

The loader also sends an encrypted browser fingerprint to the controller. That record includes the page URL, referrer, canvas and WebGL results, window.ethereum and wallet providers announced through EIP-6963.

What we see

Month	New sites
September	202
October so far	9

We have successful captures from 180 BaseTask sites since 25 September.

Checking a page

Preserve the page source, loaded scripts and network log. Look for:

• public Base RPC requests followed by AES-GCM decryption of a contract reply
• get_bundle, permit, get_resource, execute and preload in the same loader
• encrypted text/plain POST requests to the resolved controller
• IndexedDB resource caching followed by Blob or inline script execution
• wallet-provider enumeration through window.ethereum and EIP-6963

Remove the loader and its cached copies from the site's files and deployment. Review hosting and deployment access and rotate their credentials. Clear the loader's local-storage and IndexedDB entries in the test browser before checking the cleaned page again.