The FakeGit malware campaign has resurfaced, distributing the SmartLoader malware through over 17,000 fake GitHub repositories. These repositories use convincing README files with download links to ZIP archives containing SmartLoader, which then delivers additional malware such as the StealC infostealer. The campaign leverages both throwaway and apparently legitimate developer accounts to maintain a large and persistent malicious repository fleet. Attempts to remove these repositories are ineffective due to the attackers' use of multiple backup copies and alternative download locations within GitHub. Users are advised to verify repository ownership and rely on official sources for software installations.
The npm package 'clickfix_npm_delivery' contains malicious code designed as a social engineering lure. It delivers a fake Cloudflare Turnstile verification page that tricks victims into executing a PowerShell command, which downloads and runs a remote script, granting attackers arbitrary code execution on the victim's Windows machine. Installation of this package compromises the affected computer, potentially exposing all stored secrets and keys.
Threat actors are targeting the accommodation industry with email campaigns containing fake guest complaints and inquiries. These emails deliver malicious LNK shortcut files disguised as images, which deploy blockchain-abusing malware families EtherRAT and TONResolver. These malware variants use public blockchain APIs for command and control infrastructure resolution, enabling dynamic infrastructure rotation and evasion of traditional takedown methods. The campaigns evolve from earlier Booking.com spoofing operations and likely use generative AI to create unique email variants, complicating detection.
The npm package @galicia-toolkit/error-master version 999.0.3 contains malicious code that exfiltrates sensitive host and user information via DNS queries during installation. This occurs automatically on npm install without further user interaction. The package appears to be a dependency confusion attack payload designed to override an internal package. Systems with this package installed should be considered fully compromised.
The npm package @galicia-toolkit/tag-manager versions 999.0.3, 999.0.5, and 999.0.6 is a malicious dependency-confusion squat that executes code during installation to exfiltrate sensitive environment variables and host information to an external attacker-controlled server. It collects credential-grade environment variables such as AWS and GitHub tokens, enumerates system details, and sends this data via HTTP and DNS channels. The package contains no legitimate functionality and is designed solely for credential theft. Any system with this package installed should be considered fully compromised, and all secrets must be rotated immediately.
The npm package @galicia-toolkit/spa-build-config versions 999.0.3, 999.0.5, and 999.0.6 contains malicious code in its postinstall script. This script collects sensitive host and credential data, including environment variables with AWS, GitHub, npm, and GitHub Actions tokens, and exfiltrates this information to an external server. The package is likely a dependency confusion attack targeting internal scopes. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @bellaxchuu/familyxtrx version 0.1.5 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @bellaxchuu/flowblue version 1.5.7 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, enabling attackers to change targets post-installation. The malicious code abuses the installer's WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @bellaxchuu/privatebails version 1.4.1 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched to evade detection. This behavior abuses the victim's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/skyblue version 2.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The targeted channel identifiers are obfuscated or dynamically fetched at runtime to evade detection. The malicious code abuses the installer's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/velvetry versions 0.1.3 and 0.1.4 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert subscription action into the WhatsApp socket layer, leveraging the installer's authenticated WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/xtrxbails (version 0.0.8) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, preventing easy detection. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The @xayz/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The target channels are obfuscated using various techniques and may be dynamically fetched from attacker-controlled sources. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The my-baileys npm package versions 1.0.1 through 1.0.5 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing authenticated FOLLOW queries using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The npm package @itsmee_aizat.id/baileys2 versions 2.0.0, 2.0.1, and 2.0.2 includes a runtime dependency on a GitHub repository (tenka-san/libsignal-node) controlled by an unrelated user. This dependency is fetched without integrity verification, allowing whoever controls that repository to execute arbitrary code on the installer's machine. The package loads this malicious code at runtime, leading to a full compromise of any computer where it is installed or running.
The npm package albert-anitabaileys version 1.1.13 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The cantarella-baileys npm package, versions 1.1.11 through 1.1.13, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channels are obfuscated or fetched dynamically to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @nyzzpediaa/baileys-new contains malicious code that silently subscribes the installer's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel IDs are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
Since April 2026, the PoeLLM malware campaign has targeted exposed AI/LLM and open-source services such as LiteLLM, Ollama, Gotenberg, and Gitea. It uses a novel command-and-control method where infected systems extract C2 server addresses from keywords embedded in a poem on GitHub. The malware deploys cryptocurrency miners (XMRig and Iron) connecting victims to Kryptex mining infrastructure. Compromised hosts are also used as scanners and exploit servers to grow the botnet, which has affected over 3,400 servers with up to 800 active daily. The campaign is linked to an Italian-speaking threat actor and mainly impacts victims in the United States and Western Europe. Vulnerable routers are exploited to serve as C2 infrastructure.
Zohar Pinhasi, owner of MonsterCloud, was charged with defrauding ransomware victims by falsely claiming to decrypt data without paying attackers. Instead, he paid ransoms to obtain decryption keys and charged victims a substantial markup for remediation services. The scheme involved paying over $8 million in ransoms while charging clients over $19 million. He faces wire fraud charges and potential lengthy prison sentences.
