Loading story…
A threat actor has distributed a Go implementation of the Graphalgo malware through two malicious Terraform providers and two Go modules—the first reported systematic abuse of Terraform providers for malware delivery. The packages used trigger-gated, encrypted payloads to selectively infect victims, then installed a second-stage Go remote-access trojan on Windows, Linux, and macOS systems. The RAT communicated through encrypted Slack infrastructure and the Arbitrum Sepolia blockchain; shared public-key, Slack, and blockchain infrastructure links the activity to the earlier Graphalgo npm campaign.
The operators also established fake Go-package ecosystems, including gocommunity.io and gogets.dev, to make the malicious modules appear legitimate and target Go developers and DevOps staff. The expansion follows prior Graphalgo activity using fake recruiter-test lures and coincides with the separate "Equation of Compromise" npm operation targeting DeFi and quantitative developers through trigger-activated packages and Sepolia-based command-and-control. Both campaigns demonstrate continued supply-chain targeting using conditional execution, encrypted multistage payloads, and blockchain-backed C2, although the available reporting does not establish that they are operated by the same actor.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
JFrog Security Research published its analysis of Equation of Compromise, describing trigger-gated payload decryption, Ethereum Sepolia C2 contracts, Slack-based tasking, and GitHub Actions download-farming infrastructure.
The threat actor published gogets.dev/btreex, concealing its malware in a ZIP archive masquerading as btreex.sql. Forged repository commits were used to make Go module services show a falsified November 2025 release date.
The threat actor published gocommunity.io/orderedbtree, a Go module containing the malware in plaintext.
The Arbitrum Sepolia smart contract used for Graphalgo-linked blockchain command and control began receiving transactions on August 6, 2026.
The qa-announcements channel in the Portfolio-testers Slack workspace accumulated encrypted Graphalgo-related C2 messages beginning July 16, 2026.
A public key later associated with the Graphalgo-linked Go and Terraform malware was present in malicious NPM payloads beginning with the modern-events package.
The Equation of Compromise npm supply-chain campaign reportedly became active in March 2026, targeting quantitative-development and DeFi users through malicious packages including mathsbase.
A threat actor distributed a Go-based Graphalgo-linked malware through the malicious Terraform providers gocommunity-io/dockerd and typosquatted kreuzwenker/docker, as well as the gocommunity.io/orderedbtree and gogets.dev/btreex Go modules. The trigger-gated payload deployed a Go RAT using encrypted Slack and Arbitrum Sepolia blockchain command-and-control channels.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
aikido.dev
Open sourcecyberveille.ch
Open sourcereversinglabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **222 GitHub repositories** across **190 accounts** to a malware distribution campaign dubbed **Operation Muck and Load**, which used fake Go packages and deceptive software projects to trick developers into importing malicious code. The repositories were dressed up with synthetic GitHub Actions activity, manufactured commit history, and lure themes including cryptocurrency tools, Telegram bots, game cheats, and offensive utilities. Investigators tied the activity to a shared actor email address, `ischhfd83@rambler[.]ru`, and identified a malicious module, `github[.]com/kaleidora/dnsub-scanning-tool`, as a first-stage Windows loader. Once executed, the package launched obfuscated PowerShell, used a dead-drop resolver on public platforms to locate current command-and-control infrastructure, and fetched staged payloads from Muck-themed servers. The infection chain delivered malware including **Vidar infostealer**, **AsyncRAT**, **Quasar RAT**, **Remcos-style RATs**, spyware, and **Monero cryptominers** tied to XMRig. Reporting said the operation abused developer trust rather than a flaw in Go itself, but warned that Linux build pipelines, CI/CD runners, developer workstations, and cached credentials remain exposed in mixed-platform environments if malicious modules are pulled into builds.
Jul 11, 2026
North Korea-linked **Lazarus Group** has been tied to an expanded “fake recruiter” operation targeting **cryptocurrency-sector Python and JavaScript developers** by luring them with job offers and coding assessments that require installing trojanized dependencies from **npm** and **PyPI**. ReversingLabs reports the activity has been ongoing since **May 2025** and uses a multi-stage, modular infection chain that hides malicious functionality behind layers of indirection across public services such as **GitHub**, npm, and PyPI, helping the operation persist even as individual components are removed. The campaign (codenamed **Graphalgo**) reportedly uses a “bait-and-switch” approach in which initially benign packages build trust and download volume before later versions introduce malicious payloads; one highlighted npm package, **`bigmathutils`**, exceeded **10,000 downloads** prior to the malicious update. Reported package names associated with the operation include npm packages such as `graphalgo`, `graphlibcore`, and `bigmathutils`, and PyPI packages such as `graphalgo`, `graphlibx`, and `bigmathutils`; the threat actors also create supporting legitimacy artifacts (e.g., a purported crypto firm like **Veltrix Capital**, related domains, and GitHub organizations/repositories) to make the recruitment workflow appear authentic and to deliver the compromised projects used in “assessments.”
Jun 29, 2026
Security researchers reported multiple **software supply chain-style malware distribution** efforts abusing developer-adjacent platforms. JFrog detailed a malicious npm package, `@openclaw-ai/openclawai`, masquerading as an *OpenClaw* CLI installer; once executed, it uses a `postinstall` hook to reinstall globally and drop an obfuscated first-stage (`setup.js`) that deploys a multi-stage payload internally identified as **GhostLoader** (campaign tracked as **GhostClaw**). The malware is designed to persist and exfiltrate a broad set of sensitive data from developer workstations, including credentials (e.g., cloud config artifacts for **AWS/GCP/Azure**), macOS Keychain data, browser sessions, SSH keys, and cryptocurrency wallet/seed material. Separately, Trend Micro reported a large-scale distribution operation for the **BoryptGrab** information stealer via **100+ public GitHub repositories** that pose as legitimate tools and game cheats. The campaign uses SEO manipulation (keyword-stuffed READMEs and lookalike download pages) to drive victims from search results into redirect chains that ultimately deliver ZIP archives containing the stealer; some variants also deploy a PyInstaller backdoor (**TunnesshClient**) that establishes a reverse SSH tunnel for attacker communications. Reported indicators (e.g., Russian-language comments and related infrastructure) suggest a possible Russian nexus, and the observed targeting focuses on harvesting browser data, crypto wallets, system information, and user files.
Jun 29, 2026