EP. 175: MALFEX npm Campaign Delivers RATs and Credential Stealers Through Developer Packages

The Digital Warfare Podcast · Oct 6, 2026 · 5m · transcript

Summary

Fresh research details MALFEX, a long-running malicious npm campaign linked to eight malicious packages that accumulated 40,767 downloads.

The campaign uses multiple delivery chains targeting Windows systems. Payloads include the Overlord RAT, the movinlike information stealer, and additional downloader activity delivered through npm lifecycle scripts or code executed when a malicious package is loaded.

The stealer can target browser cookies and saved credentials, Telegram Desktop sessions and cryptocurrency-wallet data. The campaign also demonstrates a major package-security…