Loading malware…
25 distinct techniques documented for this family, organized by ATT&CK tactic.
the attacker didn't steal an npm token or exploit a bug in GitHub Actions this time either. They gained push access to two source repositories and let each project's own release pipeline do the publishing.
an attacker gained push access to the asyncapi/generator repository's next branch and pushed a single malicious commit... This triggered the project's legitimate release-with-changesets.yml GitHub Actions workflow... packages... were published to npm with valid SLSA provenance attestations
Persistence via systemd, crontab, launchd, or Registry autostart
spawning a detached, hidden Node.js process that downloads a second-stage payload from an IPFS gateway
plus C2-controlled self-destruct and arbitrary shell execution
When Node.js loads the modified module, the code starts a detached child process... It retrieves a second-stage file from an IPFS gateway, writes it into a user-profile directory under a plausible name, and starts it in the background.
Attackers placed an obfuscated block inside ordinary source files where network access and process creation would not be expected... When Node.js loads the modified module, the code starts a detached child process and allows the normal application or CI task to continue.
macOS persistence marker Node Auto-Update Script Shell startup-file persistence marker
Persistence via systemd, crontab, launchd, or Registry autostart
the attacker didn't steal an npm token or exploit a bug in GitHub Actions this time either. They gained push access to two source repositories and let each project's own release pipeline do the publishing.
Linux persistence miasma-monitor.service User-level systemd persistence artifact
Persistence via systemd, crontab, launchd, or Registry autostart
Persistence via systemd
Persistence via systemd, crontab, launchd, or Registry autostart
macOS persistence marker Node Auto-Update Script Shell startup-file persistence marker
Persistence via systemd, crontab, launchd, or Registry autostart
the attacker didn't steal an npm token or exploit a bug in GitHub Actions this time either. They gained push access to two source repositories and let each project's own release pipeline do the publishing.
Linux persistence miasma-monitor.service User-level systemd persistence artifact
Persistence via systemd, crontab, launchd, or Registry autostart
Persistence via systemd
Persistence via systemd, crontab, launchd, or Registry autostart
Each package contained an identical... obfuscator.io-obfuscated dropper injected into a single source file, padded with ~1000 leading spaces to hide it from diff views.
the attacker didn't steal an npm token or exploit a bug in GitHub Actions this time either. They gained push access to two source repositories and let each project's own release pipeline do the publishing.
Stage 3 decrypts (AES-256-GCM plus a rotation cipher) into a 3.08 MB bundled application: Miasma RAT itself.
Its active command handler can run arbitrary shell commands, return output...
writes it to an OS-specific hidden directory disguised as a Node.js runtime folder
Attackers placed an obfuscated block inside ordinary source files where network access and process creation would not be expected... When Node.js loads the modified module, the code starts a detached child process and allows the normal application or CI task to continue.
with dedicated targeting of GITHUB_TOKEN , NPM_TOKEN , and PYPI_TOKEN
harvests credentials... SSH keys, ~/.npmrc , ~/.gitconfig , AWS and Kubernetes credentials, Docker credentials
Credential harvesting across browser secrets (Chrome, Brave, Edge)... and macOS Keychain
LAN lateral movement via subnet scanning, service discovery, and mDNS.
A complete worm-propagation and metamorphic engine - five modules covering build-toolchain injection, runtime injection, and vector selection
Once it establishes itself on the system the payload then connects to a C2 server... Six independent C2 (command-and-control) channels - HTTP, Nostr relay, IPFS, BitTorrent DHT, a libp2p P2P mesh, and an Ethereum dead-drop contract
Six independent C2 (command-and-control) channels - HTTP, Nostr relay, IPFS, BitTorrent DHT, a libp2p P2P mesh, and an Ethereum dead-drop contract
Stage 2 downloads a second-stage script from a public IPFS gateway into an OS-specific hidden directory disguised as a Node.js runtime folder
Miasma has returned through software packages... creating a route for long-term remote access.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.