Researchers at Socket found 18 malicious npm packages that deliver a cross-platform remote access trojan to users of Alibaba developer tools, splitting the attack across many packages so each looks harmless on its own. Ten lure packages with no real function depend on a bridge package, which pulls in loaders that fetch a rule-engine configuration from GitHub and use it to run OS-specific payloads from a server disguised as Alibaba infrastructure. On Windows it even replaces a legitimate Alibaba security app with a trojanized copy. The final trojan can steal data, run commands, and move laterally, and the campaign stayed hidden for about three months.
Attackers published malicious versions of the @joyfill/components and @joyfill/layouts npm packages that run a remote access trojan as soon as the package is imported, not merely installed. Because the payload executes at import time, defenses that block install scripts, such as installing with scripts disabled, do not stop it. The malicious code sat only in the published tarballs with no matching source change, pointing to a registry or publishing pipeline compromise. Once loaded, it profiles the host, opens a remote-control channel, and can run shell commands, upload files, read the clipboard, and tamper with developer tools, using blockchain networks to resolve its next payload for resilience.
Cisco Talos detailed a financially motivated Russian group, tracked as UAT-11795, that spreads a new backdoor called Starland RAT through trojanized installers for legitimate software including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT. Active since at least mid-2025 and mainly hitting US victims, the campaign likely uses fake verification lures to deliver the installers. Once run, the malware sets up persistence, tries to escalate privileges, and detects sandboxes, then steals browser data and more than 40 kinds of cryptocurrency wallets, profiles the machine, and maps Active Directory. It can take screenshots, run shell commands, inject shellcode, and pull down further payloads, giving the operator broad control.
Researchers at Blackpoint Cyber detailed LabubaRAT, a previously undocumented Rust-based remote access trojan that disguises itself as NVIDIA software to blend into target systems. It arrives as an executable impersonating NVIDIA's container runtime, then profiles the host, identifying installed browsers and security products such as Microsoft Defender, CrowdStrike, and SentinelOne. From there it can run commands and scripts, capture screenshots, move files, and proxy traffic, and it communicates over multiple channels, including HTTPS, WebView2, and DNS tunneling, so access survives if one path is blocked. Its command server details are supplied at runtime, letting attackers reuse the same binary across campaigns, and there are signs it is sold as a service.
LevelBlue detailed QuimaRAT, a new Java-based remote access trojan sold as a service that runs across Windows, Linux, and macOS from the same codebase. Subscriptions range from about $150 for a month to $1,200 for lifetime access, lowering the bar for attackers to get cross-platform reach. Built around a modular design, it expands its capabilities through encrypted plugins that operators can load, update, or remove from their command server on the fly. It also uses several obfuscation techniques to keep changing how it looks to security tools without altering its behavior, so signatures based on its appearance are likely to go stale quickly.
JFrog found malicious npm packages that impersonate PostCSS build tools to drop a multi-stage Windows remote-access trojan on developer machines. One package, postcss-minify-selector-parser, is named to look like the widely used postcss-selector-parser library, which sees over 127 million weekly downloads, and even lists the real package as a dependency to seem plausible during a quick review. Once installed, it writes and runs a PowerShell script that pulls down the trojan. A second cluster of five packages delivers a dropper during npm install, with one server-side component that only serves the payload to victims matching a specific signature. Affected developers should remove the packages and rotate credentials.
South Korea's Genians Security Center reports that the North Korean group ScarCruft (APT37) is sending spear-phishing emails dressed up as Microsoft Account security alerts to deliver a Python-based spy tool called NarwhalRAT. The emails warn of suspicious one-time-code activity and urge the recipient to open an attached advisory, which is actually a ZIP holding a malicious shortcut. Opening it kicks off a multi-stage, in-memory infection that leaves little on disk and gains persistence through a scheduled task. NarwhalRAT can log keystrokes, capture screenshots, record audio, and steal files from USB drives, and it disguises itself as the Korean browser Naver Whale while targeting South Korean users.
Attackers compromised a backend API on CPUID's website and replaced the official download links for CPU-Z and HWMonitor with trojanized versions containing the STX RAT. The attack lasted approximately six hours between April 9-10, timed to when the lead developer was on holiday. The malicious packages used DLL sideloading - legitimate CPUID executables (still properly signed) were bundled alongside a malicious CRYPTBASE.dll that masquerades as a standard Windows library. When users launched HWMonitor or CPU-Z, the malicious DLL loaded and deployed the RAT entirely in memory, with four independent persistence paths. The primary goal was browser credential theft, specifically targeting Chrome's IElevation COM interface to dump and decrypt saved passwords. The same threat group previously compromised FileZilla downloads in early March 2026. CPUID's signed original files were not tampered with - this was an infrastructure attack redirecting download links to attacker-controlled Cloudflare R2 storage.
Kaspersky researchers uncovered CrystalRAT, a new malware-as-a-service sold via Telegram and promoted on YouTube with a tiered subscription model. Built in Go, it combines remote access via VNC, keylogging, clipboard hijacking for crypto wallet theft, browser credential stealing from Chromium/Yandex/Opera, and data harvesting from Steam, Discord, and Telegram. Each buyer gets a uniquely encrypted build using ChaCha20, making detection harder. Kaspersky warns that new versions are still shipping, and the victim count is likely to grow.
Attackers hijacked the npm account of Axios's lead maintainer and published two poisoned versions of one of JavaScript's most popular libraries - 83 million weekly downloads. Versions 1.14.1 and 0.30.4 inject a hidden dependency called plain-crypto-js that drops a cross-platform RAT targeting macOS, Windows, and Linux. The malware phones home within seconds of npm install, then deletes itself to avoid detection. Both release branches were hit within 39 minutes of each other.
TrustStrike Labs