Fast Facts
- A lone threat actor is distributing malicious npm packages—primarily "function-flag"—that deploy information stealers and remote access Trojans (RATs), infecting Windows systems through loaders, stealers, and downloaders.
- The campaign’s packages, downloaded over 40,000 times, deploy complex malware chains, including the Overlord RAT and crypto-wallet stealers, via package lifecycle hooks and remote payloads.
- Overload RAT campaigns are also exploiting WordPress flaws and fake Zoom installers, with attribution suggesting Portuguese-speaking operators targeting global tech platforms for opportunistic infiltration.
Threat, Attack Techniques, and Targets
Cybersecurity researchers revealed a campaign called MALFEX, which uses malicious npm packages. Since August 2023, a threat actor has published 12 packages, with eight identified as harmful. The main goal is to infect Windows computers. The attack has three main methods:
– Using loaders for Overlord, a remote access Trojan (RAT) written in Go that uses Solana transactions for command-and-control.
– Installing movinlike, a Node.js stealer targeting apps like Discord, browsers, Telegram, and cryptocurrency wallets.
– Downloading additional malicious files through a downloader package.
The malicious packages have been downloaded over 40,767 times, mainly through a package called “function-flag.” The attack spreads via popular platforms like npm and Discord. Some packages act as loaders that download and run Windows executables. Others fetch a Go program that loads a stealer. The attacker appears to be Portuguese-speaking based on some clues in the code. The campaign is opportunistic and targets a wide range of victims using global platforms.
Impact, Security Implications, and Remediation Guidance
The malware campaign can cause serious security issues. It can steal sensitive data from affected systems and allow remote access for the attacker. The use of popular package managers means it can quickly spread to many users. Organizations should be aware that these malicious packages are still active, especially “function-flag,” which is still live. To protect systems, users should avoid installing unknown npm packages, especially those with suspicious descriptions or recent updates. If you suspect infection, consult your security team or vendor for specific removal guidance. It is best to get official remediation steps from trusted cybersecurity authorities or the vendor involved in your software environment.
Discover More Technology Insights
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
