Loading story…
Two separate web payloads were found to contain heavily obfuscated JavaScript, and in one case WebAssembly, designed to collect detailed browser and device telemetry from visitors. The scripts gathered data such as canvas and WebGL fingerprints, browser and platform characteristics, storage and service worker status, permissions, performance metrics, WebRTC-derived local IP information, geolocation status, and error telemetry, then packaged the results into structured records for later processing or transmission.
Embedded logic also pointed to anti-fraud and anti-automation use cases, including anti-debugging checks, bot-detection routines, URL interception, cookie and session handling, hashing with SHA-1 and SHA-256, and checks for incognito mode or tampering. One payload included strings associated with DataDome and a Rust-to-WASM build pipeline, while the other contained anti-fraud checks such as canvas-noise detection and a Buhtrap-related detector, indicating sophisticated client-side tracking and detection capabilities rather than a clearly documented breach or vulnerability event.
See the reporting duties and controls this puts on the clock.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that malicious email attachments disguised as JavaScript files were being used to deliver a broad set of remote access Trojans and stealers through heavily obfuscated loader chains. HP Wolf Security identified the activity as **RATDispenser**, a stealthy JavaScript loader that decodes itself, launches `cmd.exe`, writes a VBScript file into `%TEMP%`, and then either drops or downloads a second-stage payload. Analysis of 155 samples found that **94%** acted as droppers rather than network downloaders, with **STRRAT** and **WSHRAT** making up **81%** of observed payloads; other delivered malware included **Formbook**, **Remcos**, **AdWind**, **Panda Stealer**, **GuLoader**, and **Ratty**. The campaign’s low average detection rate and layered obfuscation indicated an effective distribution mechanism for commodity malware. Separate analysis of a phishing campaign targeting European organizations showed a similar JavaScript-to-VBS infection pattern delivering **H-Worm/Houdini** after emails impersonating entities such as **UNWTO** and **IATA**. Lab52 attributed that operation to **LazyScripter** and found that the attackers’ obfuscated scripts had themselves been tampered with by the online service `hackfree.org`, which injected an additional **njRAT** downloader, creating a double-compromise scenario. Researchers linked the primary campaign to infrastructure including `stub.ignorelist.com` and `securessl.fit`, while the injected secondary activity used a PowerShell downloader that contacted `185.81.157.186` to retrieve content from `/NDA/199.png`, underscoring how obfuscated JavaScript loaders were being reused to distribute multiple RAT families through phishing.
Aug 15, 2026
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026
A Sonatype report identified six malicious **npm** packages that used **Ethereum transactions** to retrieve and stage malicious payloads, an unusual delivery method that obscures second-stage infrastructure behind blockchain activity. The campaign was linked in public reporting to **ContagiousInterview** and **NullReceiver**, indicating continued abuse of the JavaScript and Node.js ecosystem for software supply-chain compromise. The activity aligns with broader attacker tradecraft documented for **MITRE ATT&CK `T1059.007`** (**Command and Scripting Interpreter: JavaScript**), which covers JavaScript and Node.js use for payload delivery, execution, reconnaissance, and command-and-control. Defenders monitoring follow-on behavior should watch for suspicious child-process activity and discovery commands launched from non-shell parent processes, a pattern reflected in Splunk detection guidance for tools such as `ipconfig.exe`, `systeminfo.exe`, `net.exe`, and `whoami.exe` executed outside normal `cmd.exe` or PowerShell chains.
Aug 12, 2026