Threat reportSupply ChainTL-2026-2801
MALFEX: Malicious npm postinstall supply-chain campaign delivering Overlord RAT and movinlike stealer
MALFEX: Malicious npm postinstall supply-chain campaign (TL-2026-2801), also tracked as MALFEX, is a high-severity supply-chain compromise, first published 2026-09-30 and last reviewed 2026-10-10. It is attributed to MALFEX operator with medium confidence, affects npm tlxbnhd, tldriver, mxdriver (Arm A droppers), maps to 30 MITRE ATT&CK techniques (T1005, T1010, T1027.009), and is covered by 9 detection rules and 59 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 30MITRE ATT&CK
- Actors
- 1MALFEX operator
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 59Indicators of compromise
Key facts for TL-2026-2801
- Threat ID
- TL-2026-2801
- Also known as
- MALFEX
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- MALFEX operator
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, gaming, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 59
- Updates
- 2026-10-10 · 4 updates · revalidated 4× · latest source
Malware and tooling in MALFEX: Malicious npm postinstall supply-chain campaign
Malware and tooling: Overlord, Rakhni, movinlike
How MALFEX: Malicious npm postinstall supply-chain campaign works
CloudSEK attributes a 36-month npm supply-chain campaign (Aug 2023 - Sep 2026) to a single operator using two delivery arms to deploy the Overlord Go RAT and the movinlike Node.js stealer on Windows. The postinstall package function-flag was malicious from 2025-07-18 yet went unadvised for about 14 months, and function-flag and cdn-img-fetch remained unadvised and installable at report time.
CloudSEK (Vikas Kundu, 2026-09-30) reports a campaign it names MALFEX: one operator publishing roughly 12 malicious npm packages across 8+ throwaway publisher accounts between August 2023 and September 2026. Each package used a fresh npm account with a randomized iCloud email. The operator left a hardcoded key string, malfexteam2027, in payload decryption logic, and a GitHub account (cavecrew, commits at UTC-0300) hosts payloads and a public process-hollowing PoC. A cdn-img-fetch@1.0.9 README states it was made by the 'Malfex team' whose owner is 'Murizada'.
Delivery Arm A is a dropper trio (tlxbnhd, tldriver, mxdriver) whose postinstall scripts download a Windows PE disguised as a PNG from api.imghippo.com. The PE is a Microsoft IExpress cabinet holding a signed AutoIt3 interpreter and an encrypted a3x script (EA06 encryption with RC4 key 8448433, plus cycled-XOR strings). The chain executes an Overlord-client Go RAT build, persists via the AutoIt3.exe copy under %LOCALAPPDATA%\ScopeSmart Technologies Inc and the scheduled task \Maiden, and drops gldriver_pre_core.exe and gldriver_pre_asset.exe. CloudSEK reports the RAT's Solana-blockchain memo C2 channel as live in this build; Jamf had described the Solana resolver as present but disabled in a separate macOS sample.
Delivery Arm B (function-flag with wrapper function-color; cdn-img-fetch; img-to-native; native-runner; centralizemiddle as benign cover) retrieves a PNG polyglot from raw.githubusercontent.com/cavecrew/proj, decrypts the embedded payload with the malfexteam2027 key, and fetches a 64 MB Node.js bundle (movinlike) from 104.234.65.75:700. Per OSV/Amazon Inspector, img-to-native (MAL-2026-17216) reads an encrypted blob appended after the PNG IEND marker in cdn-img-fetch's cached banner.jpg, decrypts it with AES-256-CBC (key derived from sha256 of 'nif-runtime-2027'), and writes node_runtime_helper.exe to %LOCALAPPDATA%\Programs\NodeRuntime; native-runner (MAL-2026-17218) polls for %APPDATA%\Microsoft\Windows\node_runtime_helper.exe and spawns it hidden and detached. The movinlike stealer injects into Discord clients, steals browser cookies and Telegram tdata, and exfiltrates over a Discord webhook that was live at report time.
Four OSV advisories were issued 2026-09-22 to 2026-09-28, but function-flag and cdn-img-fetch stayed unadvised and installable, and img-to-native's seizure left its active dependency reachable. No CVE applies. Severity HIGH is an analyst assessment: the sources give no CVSS or severity rating.
MITRE ATT&CK techniques used in TL-2026-2801
Collection
T1005 Data from Local System; T1056.001 Input Capture; T1113 Screen Capture; T1115 Clipboard Data
Discovery
T1010 Application Window Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027.009 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerading; T1055.012 Process Hollowing; T1134.004 Access Token Manipulation; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564.003 Hide Artifacts
Exfiltration
T1030 Data Transfer Size Limits; T1567 Exfiltration Over Web Service; T1567.004 Exfiltration Over Web Service
Persistence
Execution
T1059.005 Command and Scripting Interpreter; T1059.007 JavaScript; T1059.010 Command and Scripting Interpreter; T1204.002 User Execution
Command and Control
T1102.001 Web Service; T1105 Ingress Tool Transfer
Initial Access
T1195.002 Compromise Software Supply Chain
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Resource Development
Affected products and versions in MALFEX: Malicious npm postinstall supply-chain campaign
- npm — tlxbnhd, tldriver, mxdriver (Arm A droppers)
Vulnerable versions: all published versions - npm — function-flag, function-color, cdn-img-fetch (unadvised at report time)
Vulnerable versions: all published versions - npm — img-to-native, native-runner
Vulnerable versions: 1.0.0; 1.0.1; 1.0.2; 1.0.3
Remediation for MALFEX: Malicious npm postinstall supply-chain campaign
Patches
- No patch; remove the malicious packages. Advisories: MAL-2026-17216, MAL-2026-17218
Immediate actions
- Uninstall and block function-flag, cdn-img-fetch, function-color, img-to-native, native-runner, tlxbnhd, tldriver and mxdriver in npm/registry proxies and lockfiles
- Treat any host that installed these packages as fully compromised; rotate credentials, tokens and Discord/Telegram sessions from a clean device
- Block outbound traffic to 104.234.65.75:700 and api.imghippo.com from build/dev hosts; review raw.githubusercontent.com/cavecrew/ access
- Hunt for \Maiden scheduled task, %LOCALAPPDATA%\ScopeSmart Technologies Inc\AutoIt3.exe, gldriver_pre_core.exe, gldriver_pre_asset.exe and node_runtime_helper.exe
Workarounds
- Use a private registry mirror with malware scanning and package age/reputation gating
Longer-term hardening
- Run npm installs in CI with --ignore-scripts by default and allowlist postinstall scripts
- Add dependency-tree inspection (transitive and caret-range dependencies) to package vetting
- Alert on Node.js processes spawning hidden detached executables from %APPDATA% or %LOCALAPPDATA%
Weaknesses (CWE) in MALFEX: Malicious npm postinstall supply-chain campaign
Timeline of MALFEX: Malicious npm postinstall supply-chain campaign
- Earliest activity of the single-operator MALFEX npm campaign per CloudSEK (August 2023; day approximate)
- MALFEX operator publishes the first package to npm (exact date per Checkmarx); the campaign totals 12 packages, 8 malicious and 4 benign cover packages.
- function-flag first published to npm (July 2024); early versions fetch malfex.exe from raw IPs and onrender.com hosts.
- npm package function-flag becomes continuously malicious; it then goes unadvised for about 14 months
- Latest function-flag version is released (per The Hacker News); the package keeps accumulating downloads with no advisory.
- Jamf Threat Labs documents an Overlord RAT build delivered via a fake Zoom installer on macOS, with the Solana C2 resolver disabled; it does not identify npm as a delivery path
- First of four OSV/Amazon Inspector advisories covering MALFEX packages issued (window 2026-09-22 to 2026-09-28)
- Discord webhook used by movinlike for exfiltration is created in a newly created server; new stealer downloader samples appear 25-26 September.
- MAL-2026-17216 (img-to-native) and MAL-2026-17218 (native-runner) published; advisory text names the malfexteam2027 operator identifier
- function-flag, function-color and cdn-img-fetch remain installable; function-flag and function-color have no advisory.
- Partial advisory MAL-2026-17320 published for cdn-img-fetch, covering only versions 1.0.0-1.0.1 of the four malicious versions.
- CloudSEK publishes MALFEX report: two arms, Overlord RAT and movinlike stealer; function-flag and cdn-img-fetch still unadvised and installable, Discord exfil webhook live
- Checkmarx reports 40,767 lifetime downloads (function-flag 37,419; 3,017 in the past week), identifies a third delivery path, and confirms the three packages are still installable.
- SecurityWeek reports the Checkmarx findings: 12 packages, 8 malicious, 40,767 total downloads, three independent delivery paths.
- The Hacker News and other outlets report the campaign, noting function-flag, function-color and cdn-img-fetch still active.
- Orca Research Pod publishes a MALFEX report attributing the campaign to a suspected lone Brazilian operator running five npm accounts, eight of 12 packages malicious.
Update history for TL-2026-2801
- 2026-10-10 — MALFEX npm Supply-Chain Campaign: Overlord RAT, movinlike Stealer and function-flag Downloader Reach 40,767 Downloads: What changed No severity, exploitability or status change; both reports already say HIGH / ACTIVE. New indicators (4) 1 new sha256 (function-flag@1.7.3 example.js hidden downloader), the secondary mxdriver domain www.image.com, the malfexte
- 2026-10-10 — MALFEX npm Supply-Chain Campaign Hides Executables in PNG Files to Deliver Overlord RAT and movinlike Stealer to Windows Developers: What changed No severity, exploitability, status or attribution-confidence change. The newer report rates attribution confidence LOW versus the existing MEDIUM; that would be a downgrade, so it is not applied. New indicators (5) 5 new IOCs:
- 2026-10-09 — MALFEX npm Campaign Delivers Overlord RAT and movinlike Stealer via Eight Malicious Packages (40,767+ Downloads): What changed No severity, exploitability or status change; HIGH / ACTIVE / ACTIVE stand. New indicators (5) 1 new SHA256 (signed AutoIt3.exe), SmartScope.vbs and %TEMP%\._cif_data artifacts, TapiUninstall.exe hollowing target, and git email
- 2026-10-07 — MALFEX npm Campaign: Eight Malicious Packages (40,767 Downloads) Deliver Overlord RAT and movinlike Stealer: What changed Scope broadened: a third delivery path (function-color - function-flag downloader, per-version payloads incl. node.exe, svchost.exe, malfex.exe, nocry.exe) is now documented, plus 40,767 lifetime downloads (function-flag 37,419
Sources cited for MALFEX: Malicious npm postinstall supply-chain campaign
- MALFEX - A malicious npm postinstall no advisory has caught for fourteen months (CloudSEK)
- CloudSEK MALFEX full report (PDF)
- OSV MAL-2026-17216: Malicious code in img-to-native (npm)
- OSV MAL-2026-17218: Malicious code in native-runner (npm)
- GHSA-pv7p-ghgv-268x (img-to-native)
- GHSA-jxw5-69p3-hpm4 (native-runner)
- Jamf Threat Labs: Fake Zoom installer uses .NET downloader to deliver Overlord RAT on macOS
- Overlord RAT threat profile
Detection coverage for TL-2026-2801
As of 2026-10-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2801 across Splunk SPL, Microsoft KQL and Sigma, covering 59 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.