# Cross-Platform Node.js NPM Stealer — Browser Credentials, Sensitive File Exfiltration, and WebSocket Reverse Shell (SHA256 049300aa…ddeb9, C2 216.126.225.243)

> SANS ISC handler Xavier Mertens analyzed an obfuscated cross-platform Node.js stealer (SHA256 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9, filename 'extracted-decoded.js') containing three plain-text payloads after wrapper deobfuscation: (1) a Chromium credential stealer covering 13 browsers, (2) a recursive sensitive-file exfiltration scanner targeting crypto wallets, keys, seed phrases, and secrets, and (3) a WebSocket reverse-shell module that beacons to 216.126.225.243 — an IP previously documented by Socket.dev as DPRK OtterCookie / 'Contagious Interview' C2 infrastructure. The malware targets Windows-via-WSL, macOS, and Linux using a single Node.js codebase, exfiltrates over ports 8085/8086/8087, and uses Axios with an HMAC-SHA256 key ('SuperStr0ngSecret@)@^') embedded in plain text.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0557
- **ID:** TL-2026-0557
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OVERVIEW
On 2026-05-22, SANS Internet Storm Center handler Xavier Mertens published a static analysis of an obfuscated Node.js stealer uploaded to VirusTotal as 'extracted-decoded.js' (SHA256 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9). The sample failed to execute in a sandbox, so analysis is static-only. The wrapper is obfuscated with obfuscator.io-style techniques — a long array of small Base64-encoded strings indexed by low-level arithmetic decoder functions — but the three malicious payloads themselves are embedded in plain text after wrapper deobfuscation.

CROSS-PLATFORM TARGETING
The stealer is engineered to operate across Windows (via WSL paths of the form '/mnt/c/Users/${windowsUsername}/AppData/Local'), macOS, and Linux from a single Node.js codebase. The use of WSL-rooted paths to read native Windows browser profiles is notable: it allows the stealer to harvest Windows credentials from a Linux runtime, sidestepping detection tooling that assumes a Windows process context for Chromium User Data access.

PAYLOAD 1 — BROWSER CREDENTIAL STEALER
The first payload enumerates Chromium 'User Data' directories for 13 browsers: Chrome, Brave, AVG Browser, Microsoft Edge, Opera, Opera GX, Vivaldi, Kiwi Browser, Yandex Browser, Iridium, Comodo Dragon, SRWare Iron, and Chromium itself. After reading Local State / Login Data / Cookies / Web Data SQLite stores, the harvested credentials are exfiltrated to the C2 on TCP port 8085. The same module additionally enumerates Chromium extension directories for a long list of crypto-wallet extension IDs ('wps' array), including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom (fhkbkphfeanlhnlffkpologfoccekhic), Trust Wallet (nphplpgoakhhjchkkhmiggakijnkhfnd), Coinbase Wallet, TronLink, Ronin, Binance Chain Wallet, Coin98, Argent, Keplr, Solflare, MEW CX, SafePal, Guarda, and ~25 additional wallet extension IDs.

PAYLOAD 2 — RECURSIVE SENSITIVE-FILE EXFILTRATION
The second payload is a recursive filesystem scanner that searches the victim host for files matching a SENSITIVE_FILE_PATTERNS list of ~170 entries. The patterns cluster into four families: (a) cryptocurrency artifacts — 'metamask', 'phantom', 'bitcoin', 'ethereum', 'wallet', 'ledger', 'trezor', 'electrum', 'mycelium', 'blockchain', 'rabby', 'solflare', 'keplr', 'argent', 'martian', 'petra', 'okx'; (b) cryptographic key material — '.pem', '.p12', '.pfx', '.jks', '.keys', '.p8', '.p7b', '.cer', '.crt', 'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519', 'seed', 'mnemonic', 'passphrase', 'bip39', 'bip44', 'privatekey', 'private_key', 'privkey'; (c) general secrets and credentials — 'password', 'credential', 'token', 'access_token', 'refresh_token', 'api_key', 'api_secret', 'secret', 'masterkey', 'masterpassword', '.env'; (d) document and database extensions — '.db', '.sqlite', '.sqlite3', '.sql', '.mdb', '.doc', '.docx', '.pdf', '.xls', '.xlsx', '.txt', '.json', '.csv', '.xml', '.log', '.bak'. Matching files are uploaded via HTTP POST to hxxp://216.126.225.243:8086/upload using the Axios NPM package and multipart/form-data.

PAYLOAD 3 — WEBSOCKET REVERSE SHELL
The third payload opens a WebSocket connection to the C2 on TCP port 8087 implementing reverse-shell capabilities. On first connection, the malware POSTs a host fingerprint to hxxp://216.126.225.243:8087/api/notify containing fields { 'ukey': 504, 't': 5, 'host': '504_<hostname>', 'os': '<type> <release>', 'username': '<username>', 'timestamp': <unix_ts> }. The 'ukey' value 504 likely identifies the campaign or operator. Subsequent traffic is encrypted using HMAC-SHA256 with a hard-coded key 'SuperStr0ngSecret@)@^' — the key is plain text in the binary, allowing defenders to decrypt captured traffic.

C2 INFRASTRUCTURE AND ATTRIBUTION OVERLAP
All three modules communicate with a single IP — 216.126.225.243 — on three different ports (8085/8086/8087). Xavier Mertens explicitly notes in the SANS write-up that this IP is 'known as a DPRK OtterCookie C2', citing Socket.dev's research on the North Korean 'Contagious Interview' npm-attack campaign. The SANS analysis itself stops short of formally attributing this specific sample to the DPRK operators; the linkage is via shared C2 infrastructure rather than malware family overlap. Defenders should treat 216.126.225.243 as a high-confidence DPRK-linked C2 endpoint and treat the sample as plausibly tied to the OtterCookie cluster, while keeping the formal attribution as an open question pending dynamic analysis.

DELIVERY VECTOR
The SANS write-up does not establish a delivery vector; the sample was retrieved from VirusTotal. Given the Node.js / Axios runtime and the documented Socket.dev research on the same C2 (which describes 197 malicious npm packages used as a North Korean delivery channel), the most plausible delivery pathway is via a poisoned npm package executed by a victim developer — consistent with the 'Contagious Interview' fake-recruiter / fake-coding-challenge social engineering pattern. This delivery vector is hypothesized, not confirmed by the SANS source.

DETECTION POSTURE
Because the sample failed to run in a sandbox, network-IOC-driven detection is constrained to the single C2 IP and the three exfil ports. Static / behavioral hooks are stronger: (i) the literal string 'SuperStr0ngSecret@)@^' is high-fidelity if ever observed in process memory or filesystem artifacts; (ii) any Node.js / Axios process making outbound POSTs to /upload and /api/notify on the same host with ports 8085/8086/8087 in close succession is highly anomalous; (iii) WSL-resident processes touching '/mnt/c/Users/<u>/AppData/Local/<chromium-browser>/User Data' are an unusual cross-volume access pattern worth flagging in EDR.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1518 Software Discovery
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Cross-Platform NPM Stealer — SANS Internet Storm Center](https://isc.sans.edu/diary/33006)
- [VirusTotal — 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9](https://www.virustotal.com/gui/file/049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9)
- [Inside the GitHub Infrastructure Powering North Korea's Contagious Interview Campaign (Socket.dev)](https://socket.dev/blog/north-korea-contagious-interview-npm-attacks)
- [obfuscator.io — JavaScript Obfuscator](https://obfuscator.io/)
- [Axios HTTP client (used by malware)](https://github.com/axios/axios)
- [ISC.SANS IP info — 216.126.225.243](https://isc.sans.edu/ipinfo.html?ip=216.126.225.243)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0557