FileDrop EtherHiding kit

Look-alike download sites for free software

FileDrop sites copy the download pages of free Windows software: BleachBit, CrystalMark, FurMark, FileZilla, Notepad++, OBS, ShareX, Wise Care 365, Windhawk and privacy.sexy, plus one generic software site. The operators build the sites themselves, on look-alike domains such as bleachbitsoftware[.]com and file-zilla[.]com, and on Cloudflare Pages. BleachBit has three copies, and CrystalMark the same name under four top-level domains.

Every Download button calls window.FileDrop.download(), and none links to a file. Some sites put the call inline on a link to # carrying data-filedrop-download="1", with a fallback that logs FileDrop unavailable at /filedrop.js. Others attach a handler to every [data-filedrop-download="1"] or [data-filedrop="1"] element, or load a separate filedrop-init.js or filedrop-buttons.js.

The script is /filedrop.js, in three builds from 260 to 463 KB. Every string sits RC4-encrypted in an obfuscator.io string array, and the object keys are hex-escaped. The file ends by setting globalThis.FileDrop to a download function and an init(config) that can swap the RPC services and the contract.

A Base contract gives the download server

A click on Download sends eth_call with selector 0x099e4133 to the contract written into the build. The script tries seven public Base RPC services in turn, starting with mainnet.base.org and base.publicnode.com. It accepts the reply only if it starts with http:// or https://, and keeps it in sessionStorage for the rest of the visit.

The most common build reads 0xe55b08dced66b6bf99924ec18c2b476bb9df40fb, which returned hxxps://secure-link[.]club on 1 November 2026. The other two read 0x4359890055dc647118fc7c5b0082eabd757c40c8, which returned hxxps://ficoso[.]click. The EtherHiding contract tracker follows both contracts and every destination we have decoded from them.

A handshake hands out a one-time ticket

The browser makes an ECDH P-256 key pair and posts its public key to /v1/hs on the download server. Both sides derive a shared secret, which the browser turns into an AES-GCM key. An encrypted request to /v1/t returns a ticket, and the browser opens /v1/d?t= with the ticket and a k value, saving the reply as file.zip. The server answered our scanner's handshake with a 403 and issued no ticket.

The page tells the visitor to run it

While the ZIP downloads, a "How to install" box covers the whole page, stacked above everything else on it. Its five steps: wait until the download finishes, right-click the ZIP and choose Extract All, open the extracted folder, review your changes, then run the file it names.

What we see

Month	New sites
September	0
October	2
November so far	11

Spotting a FileDrop site

On a download page, look for:

• a /filedrop.js, filedrop-init.js or filedrop-buttons.js script
• Download links to # with data-filedrop-download or data-filedrop, or a window.FileDrop.download() handler
• a Base RPC eth_call with selector 0x099e4133 after a click on Download
• POST requests to /v1/hs and /v1/t, then a /v1/d?t= download
• a full-screen div with data-fd="install"

The FileDrop sites and download servers we have found:

bleachbitsoftware[.]com
bleachbitsoftware-com.pages[.]dev
bleachbit[.]app
crystalmarksoftware[.]com
crystalmarksoftware[.]net
crystalmarksoftware[.]org
crystalmarksoftware[.]pro
furmarksoftware[.]com
file-zilla[.]com
notepad-plus-plus[.]app
projectobs[.]org
getsharexsoftware-com.pages[.]dev
wisecare365[.]org
windhawksoftware[.]com
privacysoftware[.]pro
softnexi[.]net
secure-link[.]club
ficoso[.]click

Get each tool from its own project's site. Treat any computer that ran a file from a FileDrop ZIP as compromised.