Our THOR Thunderstorm-based artifact scanning pipeline detected a malicious, newly published npm package: dotenv-async v1.0.0. Presented as an environment-configuration toolkit, it contains a Windows downloader that executes at import time and is concealed in JPEG metadata. Because environment-configuration packages are typically loaded during application startup, simply importing the package is enough to trigger the malicious chain. The downloaded winhost.exe is an unsigned NSIS installer that deploys an obfuscated Electron infostealer. It targets browser passwords, cookies, and payment data, Discord and Telegram sessions, documents, and cryptocurrency wallets and seed phrases. The malware establishes persistence as: %LOCALAPPDATA%\Microsoft\Windows\0\svchost.exe It also connects to a WebSocket gateway that provides an interactive CMD/PowerShell backdoor. Additional payloads are retrieved on demand: /browser: encrypted shellcode injected into dllhost.exe to extract browser credentials and cookies (browser.h) /update: a PowerShell loader that retrieves /jack, a native clipboard hijacker exporting StartClipjack, RunClipjackLoop, and StopClipjack. Collected data is staged in %TEMP%, compressed, uploaded to a separate TryCloudflare endpoint, and then deleted. We confirmed this multistage behavior in the analyzed artifacts. We are not attributing this activity to a specific actor, nor are we claiming that a legitimate maintainer was compromised. Domains: hardwood-studio-obviously-briefing[.]trycloudflare[.]com manufacturers-arrested-acre-foods[.]trycloudflare[.]com campus-petite-timothy-gulf[.]trycloudflare[.]com SHA-256: 2a001e4ef9933701b3d93e1a7e1e7ef67d481fac5febc96f951beabe68022322 (winhost.exe) 196f6b820aaf094b8728a11699e4e91cea464623ab0c3acebdde3d1adab59fb6 (embedded Electron executable) 79121c5d9ddfafd532c30b9c20644b9a45fadadee9163eb2e5678e4efceb4312 (browser.h shellcode) 4a439412a37048f7c4e18c5a6b6763258e6358aa77693802dccc9d9d506ebc44 (ret.ps1 Clipjack PowerShell loader)

We found a Ukraine-targeted campaign using two very different lures: an “air raid alert” document aimed broadly at Ukrainian users, and a military-specific unit property inventory. Both lead to a Telegram-controlled VBScript RAT capable of credential theft, screenshots, command execution and targeted file collection. The second lure pushes the campaign back to at least 26 August 2026. What stands out is the collection focus: CAD, BIM, GIS, LiDAR and weather-model data, combined with per-host tasking and date-based file harvesting. Full technical analysis + IOCs: github.com/NextronSystems/io…

We found a heavily obfuscated, WHQL-signed malicious kernel driver with very low detections on VirusTotal. PlugPlayService.sys - MD5: a26abe238cc339da81f4853ab16e1a6a The driver provides arbitrary memory access and directly accesses RAID devices. It also makes heavy use of control-flow obfuscation, with similarities to techniques recently documented in our blog post on RegPhantom. Samples similar to PlugPlayService.sys have also been observed dropped by xigmapper. While investigating, We identified 9 additional xigmapper UEFI samples, all with no AV detection. xigmapper executes before the OS, disables SMEP/WP and patches ntoskrnl.exe in memory via egg hunting. Of particular interest: zenither.efi - MD5: 924c410a520e6dc9aa1118474d9eb354 This specific xigmapper sample has been observed deploying kernel drivers similar to PlugPlayService.sys. Full xigmapper UEFI sample set + IOCs: github.com/NextronSystems/io… Blog post on RegPhantom nextron-systems.com/2026/03/…

🚨 Our THOR Thunderstorm-based artifact scanning pipeline identified the open-source research project BindsNET as compromised in activity linked to the DPRK-associated NullReceiver campaign. BindsNET is an established Python/PyTorch library for simulating spiking neural networks, with 1.7k GitHub stars. Three days ago, threat actors used a force-push with backdated commit timestamps to add a malicious VS Code task and an obfuscated Node.js loader disguised as a Font Awesome file. The tradecraft is consistent with known PolinRider activity. Affected commit: github.com/BindsNET/bindsnet… IOCs: 780abb9d268a2b1890bf4873d0d89d21fc86be44da685b932a54a738d2699810 (public/fonts/fa-solid-400.woff2) ETH: 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Security warning: github.com/BindsNET/bindsnet…

The REDSHELL payload is now disguised as "math.mjs", replacing the previously used .dat and .bin extensions. Our artifact scanner detected it in the npm package "hydration-vli-ui" (v1.0.0), triggering two additional YARA rules designed to flag executables masquerading as script files.

🚨 We identified 57+ malicious npm packages looking similar to previous Shai-Hulud Miasma supply-chain attacks. They have preinstall hooks which download Bun and run an obfuscated stealer targeting npm/GitHub tokens, AWS, Kubernetes and Vault secrets. gist.github.com/marius-benth…

🚨 "asphomer" published 10 backdoored npm packages targeting n8n users: - exfiltrates hostnames, IPs, environment variables - steals kubeconfig & SSH credentials - attempts Docker container escapes - injects SSH keys for persistent access - opens reverse shells to attacker C2 IOCs: gist.github.com/marius-benth…

We identified further activity linked to Iranian APT Nimbus Manticore (UNC1549), including two fake LinkedIn recruiter accounts: linkedin.com/in/kateryna-hah… linkedin.com/in/tetiana-zhen… The profiles claimed to work for SmartSight HR and STC, used professional-looking AI-generated profile images, and obtained LinkedIn’s work-email verification. Both accounts have since been flagged and removed, they were active since late 2025. Their claimed employment histories also overlap with companies impersonated in earlier phishing campaigns reported by us and Check Point Research. During our analysis, we identified infrastructure likely being prepared for further phishing activity. The first domain currently hosts a fake web design agency landing page, while the second has no visible content yet. IOCs: smart-sight-hr[.]com 30min-smartsight-hr[.]com

We spotted three new malicious npm packages impersonating legitimate blockchain libraries: - [email protected] - [email protected] - [email protected] The credential stealer targets MetaMask, Phantom, Ledger and Trezor wallets. Full list of IOCs: gist.github.com/marius-benth…

We tracked a threat actor running 5 concurrent spear-phishing campaigns against European defense and UAV supply chain targets and the most interesting part was not the LNKs. Every payload in every campaign, whether C#, Python, or HTA, used the same trick to avoid hardcoded AWS credentials: AWS Cognito Unauthenticated Identity Pools. Two POST requests to cognito-identity[.]amazonaws[.]com at runtime: GetId → IdentityId GetCredentialsForIdentity → fresh AccessKeyId + SecretKey + SessionToken (15min TTL) No static keys in the binary. No credentials to burn. The only thing embedded is the pool ID, which is not a secret. Revoke one set of STS credentials and the implant just requests new ones on the next run. We confirmed a single AWS Account (624012998337) operating 12 S3 buckets across 4 regions under IAM role Cognito_VibrPoolUnauth_Role. One Cognito pool. Five campaigns. All exfil lands in S3 signed with SigV4 HMAC-SHA256 generated natively in C# and Python, no SDK, no dependencies. The Python payload copies itself to %LOCALAPPDATA%\Microsoft\Windows\AdobeUpdater.exe, schedules an hourly task called "Adobe Updater", then uploads everything from Desktop, Downloads, and all drives A through Z to the attacker S3 bucket. If direct AWS connectivity fails it falls back to a SOCKS5 proxy at 91.147.119.182:9050 with hardcoded credentials. Progress is tracked in %APPDATA%\s3up_progress.json so interrupted uploads resume automatically. Payload locations: tmpdrop[.]s3[.]eu-west-3[.]amazonaws[.]com/pdf%20file/payload.dll tmpdrop[.]s3[.]eu-west-3[.]amazonaws[.]com/pdf%20file/stage.hta vibrbucket[.]s3[.]eu-west-3[.]amazonaws[.]com/pdf%20file/s3-uploader.exe proposaldocs-eu[.]s3[.]eu-west-3[.]amazonaws[.]com/pdf%20file/s3-uploader.exe inteldocs[.]s3[.]eu-central-1[.]amazonaws[.]com/pdf%20file/stage3.hta IOCs: gist.github.com/MalGamy12/a3… virustotal.com/gui/collectio… THOR already catches the LNK delivery layer across multiple rules: valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com…

🚨 Our artifact scanner caught @ayunlove/bails, a trojanized version of @whiskeysockets/baileys (the npm WhatsApp lib), linked to lotusbail reported by @GetKoidex. It hides a hardcoded pairing code 123LOTUS using crypto-js AES, backdooring any account that calls requestPairingCode(). The attacker uses the ?? operator to silently inject it as a fallback, only activating when no custom code is passed, making it invisible in casual code review. A second encrypted payload is decrypted at runtime and written to the logs on every successful WhatsApp connection. The attacker's calling card, a Primrose_Lotus Telegram handle. That same channel is distributing the lotusbail source code, directly tying this package to the campaign. Both strings share the same hardcoded AES key "ERROR_FILE" sitting in plaintext right beside the ciphertext: the encryption exists purely to evade static scanners, not to protect anything. Detected by rule MAL_NPM_Lotusbail_WhatsApp_Backdoor_Dec25 from @MalGamy12

We found a WHQL-signed kernel module that abuses Windows firmware table registration as a covert kernel↔user communication channel. Instead of exposing a device object and IOCTL interface, it registers a custom firmware provider ("BSBS"), allowing userland interaction through standard Windows firmware table APIs. The implementation is compact and stealthy, supporting memory allocation, memory copy operations, and indirect function dispatch from user mode into kernel context. An unusual example of firmware table registration being repurposed as a hidden ring3↔ring0 communication mechanism. Name: NewDriverMMM SHA256: 1d9224a72e64bb2aad289edc81ea0720c764511c3e2b5beb5d0d5ce82a719abd fdb3907ddda9ff9bd9ec4f8bd29aad823da77b5b3bf599813fecd034b0221189 SpcSpOpusInfo: 深圳市奥联信息安全技术有限公司 Telemetry: China 🇨🇳, Japan 🇯🇵

Update: We identified two new UNC1549 / Nimbus Manticore phishing domains hosting the same fake Ebix recruitment portal from our previous reporting: hxxps://ebix[.]portal-career[.]com hxxps://ebix-exam[.]com IOCs and rules are available in THOR Lite and THOR Cloud Lite. Sign-up and scan your systems for free right now: thorcloud-lite.nextron-syste…

🚨 Our artifact scanner detected a malicious PyPI package: "[email protected]" (publisher: "electracrimson"). The package uses "_patch.py" as a dropper to fetch the Bun runtime from GitHub and execute "_runtime.bin". Deobfuscated, the payload is a CI/CD secret stealer + self-propagator with Shai-Hulud-style worm behavior: 🔑 Steals AWS, GitHub & npm credentials ☁️ Targets AWS IMDS, ECS, Vault & k8s tokens 🐙 Uses GitHub GraphQL + npm recon to spread virustotal.com/gui/file/95d4…

Following the initial report from @wiz_io on compromised MistralAI packages, our artifact‑scanning pipeline has identified additional Shai Hulud–infected NPM artifacts: mistralai/mistralai-gcp v1.7.3 mistraliai/mistralai-azure v1.7.3 These packages are used for direct cloud deployments, and should be considered compromised as part of the ongoing Mini Shai-Hulud supply-chain campaign. Until the situation is resolved, we recommend treating all recent mistralai releases with caution and reviewing any CI/CD systems where these versions may have been installed. THOR APT Scanner already provides coverage for the currently known Shai Hulud–infected Mistral AI NPM and PyPI artifacts. related: wiz.io/blog/mini-shai-hulud-… github.com/mistralai/client-…