Graphalgo Malware Expands From npm to Malicious Terraform Providers and Go Modules

A threat actor has distributed a Go implementation of the Graphalgo malware through two malicious Terraform providers and two Go modules—the first reported systematic abuse of Terraform providers for malware delivery. The packages used trigger-gated, encrypted payloads to selectively infect victims, then installed a second-stage Go remote-access trojan on Windows, Linux, and macOS systems. The RAT communicated through encrypted Slack infrastructure and the Arbitrum Sepolia blockchain; shared public-key, Slack, and blockchain infrastructure links the activity to the earlier Graphalgo npm campaign.

The operators also established fake Go-package ecosystems, including gocommunity.io and gogets.dev, to make the malicious modules appear legitimate and target Go developers and DevOps staff. The expansion follows prior Graphalgo activity using fake recruiter-test lures and coincides with the separate "Equation of Compromise" npm operation targeting DeFi and quantitative developers through trigger-activated packages and Sepolia-based command-and-control. Both campaigns demonstrate continued supply-chain targeting using conditional execution, encrypted multistage payloads, and blockchain-backed C2, although the available reporting does not establish that they are operated by the same actor.