Loading malware…
MicrosoftSystem64 is a cross-platform Node.js SEA remote access trojan and infostealer delivered through malicious npm packages in a software supply-chain campaign. Reported delivery packages include the js-logger-pack family across 29 versions in April 2026 and later terminal-logger-utils, ts-logger-pack, pretty-logger-utils, and pinno-loggers in May 2026. The installer executed via postinstall.js, downloaded platform-specific binaries from Hugging Face, and deployed the payload on Windows, macOS, and Linux.
The malware establishes persistence across all three major desktop platforms. Reported persistence artifacts include %LOCALAPPDATA%\MicrosoftSystem64\payload.js with MicrosoftSystem64.vbs plus either the scheduled task \MicrosoftSystem64 or HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftSystem64 on Windows; ~/Library/Application Support/MicrosoftSystem64/payload.js with ~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist on macOS; and ~/.local/share/MicrosoftSystem64/payload.js with ~/.config/systemd/user/MicrosoftSystem64.service on Linux, including use of loginctl enable-linger. The implant sets its process title to MicrosoftSystem64 and communicates with hard-coded controller infrastructure including ws://195.201.194.107:8010 and HTTP on 195.201.194.107:8010; 195.201.194.107:3000 was identified as a management panel. Additional actor-attributed infrastructure mentioned in reporting includes 45.61.162.41, 151.241.109.136, and 171.22.183.235.
Capabilities described in the content include remote command execution, arbitrary file read/write, directory listing, recursive file scanning, screenshot capture every 60 seconds, clipboard monitoring, cross-platform keylogging, Telegram Desktop session theft, SSH key theft, browser credential theft, browser session clearing, self-update, and deployment of additional binaries. Recovered task and capability strings include take_screenshot, exec_command, scan_wallets, get_system_info, read_file, write_file, list_dir, scan_files, start_input_capture, stop_input_capture, clipboard_get, send_tdata, download_ssh, deploy_binary, remove_agent, update_agent, and upload_folder_hf. The malware targeted credentials and secrets from browser families, more than 80 cryptocurrency wallet extensions, Telegram Desktop/tdata, shell history files, and developer credential files such as ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.git-credentials, ~/.npmrc, ~/.pypirc, ~/.netrc, and ~/.env.
Exfiltration and staging heavily abused Hugging Face. The malware used Hugging Face both for binary hosting and for exfiltration to private datasets via the Hugging Face API and Git LFS-related endpoints. Reported related strings include https://huggingface.co/api, /repos/create, /lfs/objects/batch, application/vnd.git-lfs+json, hfToken, hfUsername, and buildDatasetName. Reporting identified the Hugging Face account jpeek998 for exfiltration and Lordplay/system-releases for binary staging and updates. The malware reportedly resumed failed uploads from local state and checked for updates every 24 hours.
The campaign targeted developers, especially crypto and trading-bot developers, through malicious GitHub lure repositories and npm packages. Multiple reports cited attribution alignment with FAMOUS CHOLLIMA / Contagious Interview, with some content also describing the activity as North Korea-connected; however, the reporting frames this as attribution by researchers rather than intrinsic malware identity. Known indicators and artifacts directly mentioned in the content include the controller IP 195.201.194.107:8010, management panel 195.201.194.107:3000, Hugging Face domain traffic to huggingface.co:443, the SEA blob SHA-256 46b9522ba2dc757ac00a513dbd98b28babb018eae92347f2cbc3c7a5020872b5, and embedded JavaScript payload SHA-256 1c83019b52be6da9583d28fe934441a74eacef0cd7dbb9d71017122de6fe7cfc. The content states that hosts executing the malicious packages should be treated as fully compromised.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MicrosoftSystem64 , a multi-platform Node.js-SEA RAT/infostealer delivered through the npm js-logger-pack family of 29 versions in Apr 2026 and the May 2026 successor packages terminal-logger-utils , ts-logger-pack , pretty-logger-utils , and pinno-loggers .
"Inside MicrosoftSystem64: A Supply Chain RAT Exfiltrating to HuggingFace" published by SafeDep.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Once installed, the malware digs in using the native persistence tools of each platform: scheduled tasks and registry keys on Windows, LaunchAgents on macOS, and systemd services with autostart entries on Linux.
Windows persistence used a VBS launcher, then either a scheduled task or registry run key: Scheduled task: \MicrosoftSystem64 Trigger: ONLOGON Privilege: LIMITED
Expected observations: node.exe spawning powershell.exe with -NoProfile and -ExecutionPolicy Bypass ... PowerShell script content containing Add-Type and C# source code
Once installed, the malware digs in using the native persistence tools of each platform: scheduled tasks and registry keys on Windows, LaunchAgents on macOS, and systemd services with autostart entries on Linux.
Windows persistence used a VBS launcher, then either a scheduled task or registry run key: Scheduled task: \MicrosoftSystem64 Trigger: ONLOGON Privilege: LIMITED
macOS persistence used: ~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist
Linux persistence used a user systemd service where possible: ~/.config/systemd/user/MicrosoftSystem64.service and called: loginctl enable-linger
Once installed, the malware digs in using the native persistence tools of each platform: scheduled tasks and registry keys on Windows, LaunchAgents on macOS, and systemd services with autostart entries on Linux.
Windows persistence used a VBS launcher, then either a scheduled task or registry run key: Scheduled task: \MicrosoftSystem64 Trigger: ONLOGON Privilege: LIMITED
macOS persistence used: ~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist
Linux persistence used a user systemd service where possible: ~/.config/systemd/user/MicrosoftSystem64.service and called: loginctl enable-linger
The embedded Windows keylogger source also contained password-context classification logic ... captured keystrokes were not just raw input. They were labeled with likely sensitivity before being sent back to the operator.
Depending on what is present, the exposed material may include ... Docker registry tokens npm or PyPI publishing tokens ... exchange API keys ... Response should include rotation or revocation of ... npm tokens PyPI tokens ... API keys
Depending on what is present, the exposed material may include ... SSH keys ... Response should include rotation or revocation of: SSH keys
The collection targets matched the lure audience ... Shell history targets included ... Developer credential targets included ... Wallet and browser-extension targets included ... Telegram Desktop collection targeted: Telegram Desktop/tdata
The embedded Windows keylogger source also contained password-context classification logic ... captured keystrokes were not just raw input. They were labeled with likely sensitivity before being sent back to the operator.
After resolving the string map, capability and infrastructure strings were recoverable, including: take_screenshot ... Screenshot Capture From Non-Interactive Node-Controlled Helpers Hypothesis ... attackers may use OS-native screenshot mechanisms through helper processes controlled by the Node.js agent
IOCs Infrastructure 195.201.194.107:3000 HTTP management panel ... huggingface.co:443 Exfiltration channel ... Requests involving /api , /repos/create , or /lfs/objects/batch paths | 195.201.194.107:8010 WebSocket C2 ... Those strings align with prior reporting on WebSocket tasking
39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A persistent Node.js-based malware family delivered via malicious GitHub/npm trading-bot lures. It copies a payload to user-writable paths under the MicrosoftSystem64 name, establishes user-level persistence across Windows/macOS/Linux, and steals developer and crypto-related data including shell history, cloud and package-manager credentials, SSH keys, wallet files/extension state, Telegram Desktop data, screenshots, files, clipboard contents, and keystrokes. It also supports command execution, file operations, SSH collection, and exfiltration via HuggingFace with WebSocket-based tasking.
Cross-platform remote access trojan delivered via poisoned npm packages that steals browser credentials, cryptocurrency wallet data, Telegram Desktop sessions, SSH keys, keystrokes, and screenshots; persists across Windows, Linux, and macOS; uses HuggingFace for binary hosting, self-updates, and exfiltration; and supports remote command execution.
A remote access trojan referenced in the context of a supply chain campaign, described as exfiltrating data to HuggingFace.
A supply-chain remote access trojan delivered via malicious npm packages. It is described as a Node.js SEA binary that steals browser credentials, cryptocurrency wallet extension data, and Telegram sessions, and exfiltrates data to HuggingFace.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.