Loading story…
A malicious package named lotusbail was discovered on the npm registry, masquerading as a legitimate WhatsApp Web API library. The package, a fork of the popular WhiskeySockets Baileys project, provides full WhatsApp API functionality while secretly stealing authentication tokens, session keys, messages, contact lists, media files, and documents from users. Researchers at Koi Security found that the package uses a malicious WebSocket wrapper to intercept all data passing through, encrypts the stolen information using multiple obfuscation techniques, and exfiltrates it to attacker-controlled servers.
In addition to data theft, lotusbail implements a covert device pairing process, linking the attacker's device to the victim's WhatsApp account and granting persistent access even after the malicious package is removed. The package has been available on npm for at least six months, accumulating over 56,000 downloads, and employs advanced anti-analysis techniques such as infinite loop traps to evade detection. Victims must manually remove unauthorized devices from their WhatsApp settings to revoke attacker access.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
As of the latest reporting, the malicious 'lotusbail' package was still available for download on npm despite public disclosure of its behavior. One report noted GitHub had not yet responded to inquiries about the package's status.
ReversingLabs publicly reported a set of 14 malicious NuGet packages targeting the cryptocurrency ecosystem, expanding awareness of parallel software supply-chain activity beyond npm. The disclosure highlighted theft of crypto assets, private keys, and Google Ads OAuth credentials.
Public reporting disclosed that the package used multiple layers of obfuscation, custom RSA encryption, compression, AES, and 27 infinite-loop anti-debugging traps to hinder analysis and conceal exfiltration. Researchers emphasized that runtime behavioral monitoring was needed because static code review and reputation checks could miss the threat.
Koi Security researchers identified that 'lotusbail' had been downloaded more than 56,000 times and was intercepting messages, authentication tokens, contacts, media, and documents from developer environments. They found the package also abused WhatsApp multi-device pairing to keep attacker access even after the package was removed.
A separate supply-chain campaign involving 14 malicious NuGet packages impersonating cryptocurrency-related libraries began operating in the wild. The packages were used to steal funds, private keys, and Google Ads OAuth credentials while inflating trust through fake popularity signals and rapid versioning.
The trojanized npm package 'lotusbail,' masquerading as a WhatsApp Web API library based on the legitimate Baileys project, was available on npm starting around May 2025. It provided real functionality while secretly stealing WhatsApp data and enabling persistent account access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcehackread.com
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourcecsoonline.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **PhantomSub**, a coordinated npm supply-chain campaign in which 101 malicious packages abuse forks of Baileys, an unofficial WhatsApp API library. When developers authenticate WhatsApp through affected packages, the code silently subscribes their accounts to attacker-controlled groups or channels, sometimes muting them to avoid detection. The packages have accumulated about 490,000 downloads, including 116,000 in the prior 30 days, and many remained available as of September 28. The packages retrieve target channel identifiers from GitHub-hosted lists or conceal them as plaintext, Base64-encoded, or otherwise obfuscated values. The operation appears designed to manufacture follower counts and social proof for channels promoting bot scripts, premium APKs, gaming resources, social-media boosting, and account sales, largely within an Indonesian-focused ecosystem. Shared channel IDs, GitHub infrastructure, and nearly identical package names indicate coordinated or overlapping operators; removals have not ended the threat because new variants continue to be published.
Sep 29, 2026
A phishing campaign targeting high-profile individuals involved in Iran-related activities has been using WhatsApp messages to lure victims to a fake site that impersonates *WhatsApp Web* and steals access to accounts and other credentials. U.K.-based Iranian activist and investigator **Nariman Gharib** shared the phishing link and technical findings, which indicated the operation aimed to compromise WhatsApp accounts and harvest credentials (including **Gmail** and other online logins), with victims including a Middle Eastern academic in national security studies, the head of an Israeli drone maker, a senior Lebanese cabinet minister, at least one journalist, and individuals with U.S. phone numbers. TechCrunch reported it was able to view a real-time copy of victim submissions because the attackers’ server storing responses was left exposed without a password, showing dozens of victims had entered credentials and were likely subsequently compromised. Technical reporting described the attack as a “surveillance kit” that hijacks accounts by abusing the WhatsApp Web linking flow: the phishing page continuously polls the attacker’s infrastructure and presents a live QR code tied to the attacker’s own WhatsApp Web session, so when a victim scans it they unknowingly authenticate the attacker’s browser and link their account. The infrastructure was reported as hosted on a **DuckDNS** domain and running on an **Ubuntu** server with **nginx**. Beyond account takeover, the kit was described as requesting browser permissions that could enable invasive monitoring—camera, microphone, and location access—allowing attackers to capture photos, record audio in intervals, and track location in near real time; attribution remained uncertain in one report, while another linked the activity to Iranian intelligence.
Jun 29, 2026
The **Astaroth** banking trojan has added a spambot component that hijacks victims’ active **WhatsApp Web** sessions to distribute malicious ZIP attachments, with activity primarily targeting users in Brazil. According to CrowdStrike, the malware launches a headless **Chromium** or **Microsoft Edge** browser through WebDriver, suppresses automation indicators, checks whether the victim is already logged in to WhatsApp Web, and then uses the legitimate **WPPConnect/WA-JS** library to enumerate contacts and send messages that appear to come from the victim’s own account. The spambot is designed to maximize delivery while reducing suspicion, filtering out groups, broadcasts, linked devices, unsaved contacts, the victim’s own account, and non-Brazilian phone numbers, while tailoring Portuguese greetings by time of day before sending lures. CrowdStrike also found substantial code and configuration overlap with the earlier **Vareg** spambot—including nearly identical contact filtering, message delivery logic, and delay behavior—indicating likely code sharing or a common developer; researchers published detection guidance, a **YARA** rule, and related filesystem, telemetry, hash, and domain indicators tied to the campaign.
Jul 31, 2026