Loading story…
Researchers reported the first confirmed appearance of the PylangGhost remote access trojan on the npm registry, where it was hidden in two malicious JavaScript packages: @jaime9008/math-service and react-refresh-update. The activity has been linked to FAMOUS CHOLLIMA, a North Korean state-sponsored threat group previously associated with developer-focused social engineering and trojanized software campaigns. The packages were reportedly uploaded by the user jaime9008, tied to the email jaimeandujo086[@]gmail.com, and contained a PylangGhost loader embedded in files including runtime.js, babel.js, and lib/lib.js.
The reported campaign used the hardcoded identifier "ML2J" and communicated with infrastructure including malicanbur[.]pro and 173.211.46[.]22:8080. The reporting indicates the npm activity represents an escalation of software supply chain targeting aimed at developers and development pipelines, extending a malware family that had previously been disclosed by Cisco Talos and attributed to the same DPRK-linked actor. A social post amplifying the Kmsec finding is consistent with that same event, while separate posts about Konni spear-phishing and KakaoTalk-linked activity describe a different DPRK-related campaign and are not part of this incident.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers reported the first observed instance of the North Korea-linked PylangGhost RAT on the npm registry and attributed the activity to FAMOUS CHOLLIMA. The report also disclosed campaign details including the "ML2J" identifier and infrastructure such as malicanbur[.]pro and 173.211.46[.]22:8080.
In early 2026, the npm user "jaime9008" published two malicious JavaScript packages, @jaime9008/math-service and react-refresh-update, that contained a loader for the PylangGhost remote access trojan. The packages targeted Windows, macOS, and Linux systems as part of a software supply chain campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean-linked threat actor **Famous Chollima** has been using fake job interviews and skill assessments to infect cryptocurrency and Web3 professionals with the **PylangGhost** and **GolangGhost** remote access trojans. Researchers said the operation impersonates firms including Coinbase, Robinhood, Uniswap, Archblock, and Parallel Studios, with lures delivered through LinkedIn, Discord, Telegram, email, and fraudulent interview sites. Victims are told to fix supposed camera or microphone problems by copying and pasting malicious commands, a **ClickFix/ClickFake** technique that installs malware on Windows and macOS systems; recent reporting said Linux was not targeted in the latest wave. The malware provides remote shell access, file transfer, system reconnaissance, persistence, and theft of browser credentials, cookies, and data from more than 80 browser extensions, including cryptocurrency wallets and password managers. Reporting indicates **PylangGhost** is a Python-based RAT functionally similar to GolangGhost, while **GolangGhost** on macOS can also deploy a SwiftUI credential harvester; both families use encrypted HTTP-based command-and-control communications. Investigators also described tailored fake assessment panels, invite-link validation, browser fingerprinting, mobile-device blocking, countdown timers, clipboard hijacking, and typosquatted infrastructure hosted largely through providers such as Hostinger and NameCheap, underscoring a financially motivated DPRK campaign aimed at stealing cryptocurrency and gaining access to company funds.
Jul 22, 2026
Security researchers reported multiple **software supply chain-style malware distribution** efforts abusing developer-adjacent platforms. JFrog detailed a malicious npm package, `@openclaw-ai/openclawai`, masquerading as an *OpenClaw* CLI installer; once executed, it uses a `postinstall` hook to reinstall globally and drop an obfuscated first-stage (`setup.js`) that deploys a multi-stage payload internally identified as **GhostLoader** (campaign tracked as **GhostClaw**). The malware is designed to persist and exfiltrate a broad set of sensitive data from developer workstations, including credentials (e.g., cloud config artifacts for **AWS/GCP/Azure**), macOS Keychain data, browser sessions, SSH keys, and cryptocurrency wallet/seed material. Separately, Trend Micro reported a large-scale distribution operation for the **BoryptGrab** information stealer via **100+ public GitHub repositories** that pose as legitimate tools and game cheats. The campaign uses SEO manipulation (keyword-stuffed READMEs and lookalike download pages) to drive victims from search results into redirect chains that ultimately deliver ZIP archives containing the stealer; some variants also deploy a PyInstaller backdoor (**TunnesshClient**) that establishes a reverse SSH tunnel for attacker communications. Reported indicators (e.g., Russian-language comments and related infrastructure) suggest a possible Russian nexus, and the observed targeting focuses on harvesting browser data, crypto wallets, system information, and user files.
Jun 29, 2026
North Korean state-sponsored threat actors have significantly escalated their 'Contagious Interview' campaign by flooding the npm registry with over 338 malicious packages designed to steal cryptocurrency and sensitive credentials. The operation leverages a repeatable playbook, with threat actors creating more than 180 fake personas and using new npm aliases and registration emails to distribute the malware. These malicious packages have collectively been downloaded over 50,000 times, indicating a substantial reach and potential impact on the developer community. The attackers primarily target Web3, cryptocurrency, and blockchain developers, as well as technical job seekers, often approaching them on LinkedIn under the guise of recruiters or hiring managers. The campaign follows a multi-stage attack chain, beginning with reconnaissance on social media, followed by weaponization through the publication of typosquatted npm packages. Delivery occurs via recruiter lures, leading to exploitation through malware loaders that execute in memory. The malware tooling has evolved, with initial stages using direct BeaverTail droppers, and more recent waves employing HexEval, XORIndex, and encrypted loaders that reconstruct BeaverTail in memory. Once executed, these loaders typically fetch the InvisibleFerret backdoor, which establishes persistence and enables further malicious actions. The attackers use over a dozen command and control endpoints to manage the compromised systems. The campaign is iterative, with new malicious packages appearing weekly and loader code being regularly tweaked to evade detection. The npm security team has been notified, and takedown requests have been submitted, but as of the latest reports, 25 malicious packages remain live on the registry. The operation has resulted in multi-stage compromises, including the theft of wallet keys and sensitive credentials, leading to financial losses for victims. The attackers' use of social engineering, technical obfuscation, and rapid distribution across new aliases demonstrates a high level of sophistication and adaptability. The campaign has been mapped to the Lockheed Martin Cyber Kill Chain, illustrating its comprehensive approach from reconnaissance to actions on objectives. Security researchers emphasize the need for heightened vigilance among developers, especially those in the cryptocurrency and blockchain sectors, and recommend immediate review of npm dependencies and enhanced monitoring for suspicious package activity. The ongoing nature of the campaign and the attackers' ability to quickly adapt their tactics pose a persistent threat to the software supply chain. Organizations are urged to implement robust security controls, educate staff about social engineering risks, and coordinate with npm and security vendors to mitigate exposure. The incident highlights the growing risk of supply chain attacks via open-source ecosystems and the need for industry-wide collaboration to address such threats.
Jun 29, 2026