Cross-Platform Node.js NPM Stealer — Browser Credentials, Sensitive File Exfiltration, and WebSocket Reverse Shell (SHA256 049300aa…ddeb9, C2 216.126.225.243) — Threadlinqs Intelligence
As of 2026-05-30, Cross-Platform Node.js NPM Stealer — Browser Credentials, Sensitive File Exfiltration, and WebSocket Reverse Shell (SHA256 049300aa…ddeb9, C2 216.126.225.243) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0557 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
SANS ISC handler Xavier Mertens analyzed an obfuscated cross-platform Node.js stealer (SHA256 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9, filename 'extracted-decoded.js')
OVERVIEW
On 2026-05-22, SANS Internet Storm Center handler Xavier Mertens published a static analysis of an obfuscated Node.js stealer uploaded to VirusTotal as 'extracted-decoded.js' (SHA256 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9). The sample failed to execute in a sandbox, so analysis is static-only. The wrapper is obfuscated with obfuscator.io-style techniques — a long array of small Base64-encoded strings indexed by low-level arithmetic decoder functions — but the three malicious payloads themselves are embedded in plain text after wrapper deobfuscation.
CROSS-PLATFORM TARGETING
The stealer is engineered to operate across Windows (via WSL paths of the form '/mnt/c/Users/${windowsUsername}/AppData/Local'), macOS, and Linux from a single Node.js codebase. The use of WSL-rooted paths to read native Windows browser profiles is notable: it allows the stealer to harvest Windows credentials from a Linux runtime, sidestepping detection tooling that assumes a Windows process context for Chromium User Data access.
PAYLOAD 1 — BROWSER CREDENTIAL STEALER
The first payload enumerates Chromium 'User Data' directories for 13 browsers: Chrome, Brave, AVG Browser, Microsoft Edge, Opera, Opera GX, Vivaldi, Kiwi Browser, Yandex Browser, Iridium, Comodo Dragon, SRWare Iron, and Chromium itself. After reading Local State / Login Data / Cookies / Web Data SQLite stores, the harvested credentials are exfiltrated to the C2 on TCP port 8085. The same module additionally enumerates Chromium extension directories for a long list of crypto-wallet extension IDs ('wps' array), including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom (fhkbkphfeanlhnlffkpologfoccekhic), Trust Wallet (nphplpgoakhhjchkkhmiggakijnkhfnd), Coinbase Wallet, TronLink, Ronin, Binance Chain Wallet, Coin98, Argent, Keplr, Solflare, MEW CX, SafePal, Guarda, and ~25 additional wallet extension IDs.
PAYLOAD 2 — RECURSIVE SENSITIVE-FILE EXFILTRATION
The second payload is a recursive filesystem scanner that searches the victim host for files matching a SENSITIVE_FILE_PATTERNS list of ~170 entries. The patterns cluster into four families: (a) cryptocurrency artifacts — 'metamask', 'phantom', 'bitcoin', 'ethereum', 'wallet', 'ledger', 'trezor', 'electrum', 'mycelium', 'blockchain', 'rabby', 'solflare', 'keplr', 'argent', 'martian', 'petra', 'okx'; (b) cryptographic key material — '.pem', '.p12', '.pfx', '.jks', '.keys', '.p8', '.p7b', '.cer', '.crt', 'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519', 'seed', 'mnemonic', 'passphrase', 'bip39', 'bip44', 'privatekey', 'private_key', 'privkey'; (c) general secrets and credentials — 'password', 'credential', 'token', 'access_token', 'refresh_token', 'api_key', 'api_secret', 'secret', 'masterkey', 'masterpassword', '.env'; (d) document and database extensions — '.db', '.sqlite', '.sqlite3', '.sql', '.mdb', '.doc', '.docx', '.pdf', '.xls', '.xlsx', '.txt', '.json', '.csv', '.xml', '.log', '.bak'. Matching files are uploaded via HTTP POST to hxxp://216.126.225.243:8086/upload using the Axios NPM package and multipart/form-data.
PAYLOAD 3 — WEBSOCKET REVERSE SHELL
The third payload opens a WebSocket connection to the C2 on TCP port 8087 implementing reverse-shell capabilities. On first connection, the malware POSTs a host fingerprint to hxxp://216.126.225.243:8087/api/notify containing fields { 'ukey': 504, 't': 5, 'host': '504_<hostname>', 'os': '<type> <release>', 'username': '<username>', 'timestamp': <unix_ts> }. The 'ukey' value 504 likely identifies the campaign or operator. Subsequent traffic is encrypted using HMAC-SHA256 with a hard-coded key 'SuperStr0ngSecret@)@^' — the key is plain text in the binary, allowing defenders to decrypt captured traffic.
C2 INFRASTRUCTURE AND ATTRIBUTION OVERLAP
All three modules communicate with a single IP — 216.126.225.243 — on three different ports (8085/8086/8087). Xavier Mertens explicitly notes in the SANS write-up that this IP is 'known as a DPRK OtterCookie C2', citi
Weaknesses (CWE)
CWE-798, CWE-522, CWE-200, CWE-552
Target sectors: technology, cryptocurrency, financial, developers, software-development
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1588, T1195, T1059, T1204, T1027, T1140, T1027, T1555, T1552