Malware

lotusbail

Lotusbail is a malicious npm package (trojanized dependency) masquerading as a WhatsApp Web API library and presented as a fork/wrapper of the legitimate Baileys / @whiskeysockets/baileys project. It was available on npm for roughly six months (uploaded May 2025) and accumulated >56,000 downloads. The package provides real WhatsApp integration functionality to evade suspicion and static/reputation-based detection.

Capabilities and behavior (as described):

Credential/data theft from WhatsApp Web API usage: intercepts WhatsApp authentication tokens/credentials, session keys, message history (sent/received), contacts, and media/documents by wrapping the legitimate WebSocket client and duplicating data flows.
Exfiltration: stolen data is encrypted with a custom RSA implementation prior to transmission; the exfiltration destination/server details are heavily obfuscated (reported techniques include Unicode variable manipulation, LZString compression, Base-91 encoding, and AES-encrypted configuration strings).
Account takeover/persistence: hijacks WhatsApp multi-device pairing by using a hardcoded (AES-encrypted) pairing code to silently link an attacker-controlled device to the victim’s WhatsApp account, granting full access (read/send messages, download media, access contacts). This access persists even after the package is uninstalled/removed unless the victim manually unlinks the rogue device in WhatsApp settings.
Anti-analysis/anti-debugging: includes 27 anti-analysis traps (e.g., infinite loops) and freezes execution when debuggers/sandboxes are detected.

Infection vector / targeting:

Supply-chain attack via the npm ecosystem, targeting developers and environments that install/use the package as a WhatsApp API dependency.

Attribution / reporting:

Discovered and reported by Koi Security (including researchers Tuval Admoni and Idan Dardikman). No specific threat actor attribution is provided in the content.

Known indicators of compromise:

The content does not provide specific domains/IPs/URLs for the exfiltration infrastructure; it only states that seed phrases/tokens/data were exfiltrated to attacker-controlled infrastructure with server details obfuscated.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

"The lotusbail npm package presents itself as a WhatsApp Web API library - a fork of the legitimate @whiskeysockets/baileys package... Behind that working functionality: sophisticated malware..."

Persistence

1 technique

T1098Account ManipulationEvidence1

"The malware hijacks this process with a hardcoded pairing code... linking the threat actor's device... persistent access... uninstalling... device stays linked"

Privilege Escalation

1 technique

T1098Account ManipulationEvidence1

"The malware hijacks this process with a hardcoded pairing code... linking the threat actor's device... persistent access... uninstalling... device stays linked"

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

"The exfiltration server URL is buried in encrypted configuration strings... four layers of obfuscation: Unicode variable manipulation, LZString compression, Base-91 encoding, and AES encryption."

T1622Debugger EvasionEvidence1

"The package includes 27 infinite loop traps that freeze execution if debugging tools are detected... detect sandbox environments"

Credential Access

3 techniques

T1056Input CaptureEvidence1

"When messages arrive, it intercepts them. When you send messages, it records them."

T1555.003Credentials from Web BrowsersEvidence1

"When you authenticate, the wrapper captures your credentials... Authentication tokens and session keys"

T1557Adversary-in-the-MiddleEvidence1

"The package wraps the legitimate WebSocket client that communicates with WhatsApp. Every message... passes through the malware's socket wrapper first."

Discovery

1 technique

T1622Debugger EvasionEvidence1

"The package includes 27 infinite loop traps that freeze execution if debugging tools are detected... detect sandbox environments"

Collection

3 techniques

T1056Input CaptureEvidence1

"When messages arrive, it intercepts them. When you send messages, it records them."

T1213Data from Information RepositoriesEvidence1

"Complete message history (past and present) Full contact lists with phone numbers Media files and documents"

T1557Adversary-in-the-MiddleEvidence1

"The package wraps the legitimate WebSocket client that communicates with WhatsApp. Every message... passes through the malware's socket wrapper first."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

"...prepared for exfiltration... includes a complete, custom RSA implementation for encrypting the data before transmission"

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

checkpoint research blogNews

Dec 29, 2025

29th December - Threat Intelligence Report - Check Point Research

Malicious npm package (supply-chain) posing as a WhatsApp Web API library; intercepts messages and steals session/authentication data, contacts, and media by tampering with WebSocket traffic and hijacking device pairing.

securityaffairsNews

Dec 27, 2025

NPM package with 56,000 downloads compromises WhatsApp accounts

Lotusbail is a malicious NPM package masquerading as a WhatsApp Web API library. It intercepts WhatsApp credentials, messages, contacts, and media, exfiltrates them using custom RSA encryption, and installs a persistent backdoor by hijacking the device pairing process. It employs anti-debugging techniques and obfuscation to evade detection, representing a sophisticated supply chain attack.

hackreadNews

Dec 26, 2025

lotusbail is a malicious NPM package that masquerades as a legitimate WhatsApp library. It hijacks WhatsApp accounts, steals private data (contacts, media, messages, authentication tokens), and maintains persistent backdoor access by linking the attacker's device to the victim's WhatsApp account. It uses custom RSA encryption to exfiltrate data and includes anti-analysis traps to hinder investigation.

security online infoNews

Dec 25, 2025

“LotusBail” Trap: 56,000 Developers Downloaded a Fake WhatsApp API That Works perfectly—While Stealing Everything

LotusBail is a stealer malware distributed as a fake WhatsApp API, designed to exfiltrate sensitive information from developers who download and use it.

+6 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

lotusbail

Capabilities and behavior (as described):

Credential/data theft from WhatsApp Web API usage: intercepts WhatsApp authentication tokens/credentials, session keys, message history (sent/received), contacts, and media/documents by wrapping the legitimate WebSocket client and duplicating data flows.
Exfiltration: stolen data is encrypted with a custom RSA implementation prior to transmission; the exfiltration destination/server details are heavily obfuscated (reported techniques include Unicode variable manipulation, LZString compression, Base-91 encoding, and AES-encrypted configuration strings).
Account takeover/persistence: hijacks WhatsApp multi-device pairing by using a hardcoded (AES-encrypted) pairing code to silently link an attacker-controlled device to the victim’s WhatsApp account, granting full access (read/send messages, download media, access contacts). This access persists even after the package is uninstalled/removed unless the victim manually unlinks the rogue device in WhatsApp settings.
Anti-analysis/anti-debugging: includes 27 anti-analysis traps (e.g., infinite loops) and freezes execution when debuggers/sandboxes are detected.

Infection vector / targeting:

Supply-chain attack via the npm ecosystem, targeting developers and environments that install/use the package as a WhatsApp API dependency.

Attribution / reporting:

Discovered and reported by Koi Security (including researchers Tuval Admoni and Idan Dardikman). No specific threat actor attribution is provided in the content.

Known indicators of compromise:

The content does not provide specific domains/IPs/URLs for the exfiltration infrastructure; it only states that seed phrases/tokens/data were exfiltrated to attacker-controlled infrastructure with server details obfuscated.