# PhantomSub: 101 Malicious npm Baileys Forks Force Developers' WhatsApp Accounts into Attacker-Controlled Groups/Channels

> PhantomSub is a supply-chain campaign of 101 malicious npm packages that are modified forks of the Baileys WhatsApp library. At runtime they use the developer's authenticated WhatsApp session to follow attacker-chosen channels and join attacker-chosen groups without consent, and they inject promotional URLs into bot-sent media. The packages total about 490,000 downloads, 116,000 of them in the last 30 days.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2785
- **ID:** TL-2026-2785
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OX Security (Nir Zadok, Moshe Siman Tov Bustan, Vitalii Chepurko) reported PhantomSub on 2026-09-29 as 101 npm packages that copy the open-source Baileys WhatsApp Web API library (@whiskeysockets/baileys). The forks keep the library's API so they work as drop-in replacements for developers building WhatsApp bots. The added code acts inside the developer's already-authenticated WhatsApp session. It adds the account to attacker-controlled groups and channels without consent, and it injects promotional URLs into media the bot sends. The reporting describes promotion of game accounts, bot scripts, premium APKs and social-media boosting services, mostly Indonesian-oriented.

OX Security identified three implementation variants. In variant 1 (19 packages) the target channel IDs are fetched from GitHub at runtime. In variant 2 (60 packages) the channel IDs are embedded in cleartext in the source. In variant 3 (14 packages) the channel IDs are embedded in encoded or obfuscated form. The article's variant counts sum to 93, not 101, so the split for the remaining packages is not stated. Identified targets are the WhatsApp groups/channels Neural (798 followers, resource supplies marketplace), MONTE - BMG (1,000), CORTANA TECH (1,300) and Fyxzpedia.ID - Utama (4,800).

Independent per-package analyses (OSV MAL advisories, Xygeni, OffSeq/hacktron) show the shared mechanism. The injection sits in library socket/newsletter code (lib/Socket/newsletter.js, or lib/Socket/socket.js for chromestaff-baileys). It runs after module load or connection, not at install time. It fires after a delay: 80 seconds for @dappaoffc/baileys-mod, 120 seconds for my-auto-follow and 200 seconds for @fyxzpediaa/baileys. It then fetches a JSON list of newsletter JIDs from an attacker-controlled raw.githubusercontent.com file, or reads hardcoded JIDs, and calls the library's internal newsletter follow query (newsletterWMexQuery with QueryIds.FOLLOW, or followNewsletterWMex). Errors are swallowed silently. Because the list is remote, the attacker can retarget without republishing. Some forks also alias the libsignal dependency to a malicious variant (@skyzopedia/libsignal-node) and use unpinned git dependencies.

Timeline per the sources: SafeDep disclosed the initial malicious Baileys fork behaviour in August 2026, Xygeni disclosed @dappaoffc/baileys-mod in early September 2026, and OX Security published the consolidated PhantomSub analysis on 2026-09-29. The sources do not report credential theft, persistence or host code execution. The documented impact is loss of control over the account's group/channel membership and social-graph actions, and use of the developer's identity for promotion. Severity is an analyst judgement (MEDIUM) because no CVE or CVSS exists. Only the single OX/The Hacker News article was verified for campaign-wide numbers, since the OX, SafeDep and Xygeni primary campaign reports were not directly retrievable. The per-package technical detail comes from OSV, Xygeni and OffSeq/hacktron pages.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1497.003 Time Based Checks
- T1059.007 JavaScript
- T1102.001 Dead Drop Resolver
- T1583.006 Web Services
- T1565.002 Transmitted Data Manipulation

## Sources

- [101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent](https://thehackernews.com/2026/09/101-malicious-npm-packages-add.html)
- [Xygeni: Malicious npm Package in Baileys Fork (Skyzopedia case)](https://xygeni.io/blog/malicious-npm-package-in-baileys-fork-skyzopedia-case/)
- [OSV MAL-2026-16070: @fyxzpediaa/baileys](https://osv.dev/vulnerability/MAL-2026-16070)
- [OSV MAL-2026-4519: chromestaff-baileys](https://osv.dev/vulnerability/MAL-2026-4519)
- [OSV MAL-2026-13932: my-auto-follow](https://osv.dev/vulnerability/MAL-2026-13932)
- [OffSeq: Malicious code in my-auto-follow (npm)](https://radar.offseq.com/threat/malicious-code-in-my-auto-follow-npm-1a56842b4a4ea40b)
- [hacktron.ai: naileys 0.5.2 malicious package analysis](https://www.hacktron.ai/package/npm/naileys/0.5.2)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2785