# MALFEX: Malicious npm postinstall supply-chain campaign delivering Overlord RAT and movinlike stealer

> CloudSEK attributes a 36-month npm supply-chain campaign (Aug 2023 - Sep 2026) to a single operator using two delivery arms to deploy the Overlord Go RAT and the movinlike Node.js stealer on Windows. The postinstall package function-flag was malicious from 2025-07-18 yet went unadvised for about 14 months, and function-flag and cdn-img-fetch remained unadvised and installable at report time.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-10-10T18:12:16.851Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2801
- **ID:** TL-2026-2801
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** MALFEX operator
- **Detections:** 9 · **IOCs:** 59 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CloudSEK (Vikas Kundu, 2026-09-30) reports a campaign it names MALFEX: one operator publishing roughly 12 malicious npm packages across 8+ throwaway publisher accounts between August 2023 and September 2026. Each package used a fresh npm account with a randomized iCloud email. The operator left a hardcoded key string, malfexteam2027, in payload decryption logic, and a GitHub account (cavecrew, commits at UTC-0300) hosts payloads and a public process-hollowing PoC. A cdn-img-fetch@1.0.9 README states it was made by the 'Malfex team' whose owner is 'Murizada'.

Delivery Arm A is a dropper trio (tlxbnhd, tldriver, mxdriver) whose postinstall scripts download a Windows PE disguised as a PNG from api.imghippo.com. The PE is a Microsoft IExpress cabinet holding a signed AutoIt3 interpreter and an encrypted a3x script (EA06 encryption with RC4 key 8448433, plus cycled-XOR strings). The chain executes an Overlord-client Go RAT build, persists via the AutoIt3.exe copy under %LOCALAPPDATA%\ScopeSmart Technologies Inc and the scheduled task \Maiden, and drops gldriver_pre_core.exe and gldriver_pre_asset.exe. CloudSEK reports the RAT's Solana-blockchain memo C2 channel as live in this build; Jamf had described the Solana resolver as present but disabled in a separate macOS sample.

Delivery Arm B (function-flag with wrapper function-color; cdn-img-fetch; img-to-native; native-runner; centralizemiddle as benign cover) retrieves a PNG polyglot from raw.githubusercontent.com/cavecrew/proj, decrypts the embedded payload with the malfexteam2027 key, and fetches a 64 MB Node.js bundle (movinlike) from 104.234.65.75:700. Per OSV/Amazon Inspector, img-to-native (MAL-2026-17216) reads an encrypted blob appended after the PNG IEND marker in cdn-img-fetch's cached banner.jpg, decrypts it with AES-256-CBC (key derived from sha256 of 'nif-runtime-2027'), and writes node_runtime_helper.exe to %LOCALAPPDATA%\Programs\NodeRuntime; native-runner (MAL-2026-17218) polls for %APPDATA%\Microsoft\Windows\node_runtime_helper.exe and spawns it hidden and detached. The movinlike stealer injects into Discord clients, steals browser cookies and Telegram tdata, and exfiltrates over a Discord webhook that was live at report time.

Four OSV advisories were issued 2026-09-22 to 2026-09-28, but function-flag and cdn-img-fetch stayed unadvised and installable, and img-to-native's seizure left its active dependency reachable. No CVE applies. Severity HIGH is an analyst assessment: the sources give no CVSS or severity rating.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1053.005 Scheduled Task
- T1055.012 Process Hollowing
- T1218 System Binary Proxy Execution
- T1036.005 Match Legitimate Resource Name or Location
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1567 Exfiltration Over Web Service
- T1204.002 User Execution
- T1059.010 Command and Scripting Interpreter
- T1134.004 Access Token Manipulation
- T1036.008 Masquerading
- T1564.003 Hide Artifacts
- T1528 Steal Application Access Token
- T1056.001 Input Capture
- T1113 Screen Capture
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1102.001 Web Service
- T1567.004 Exfiltration Over Web Service
- T1030 Data Transfer Size Limits
- T1608.001 Stage Capabilities
- T1059.005 Command and Scripting Interpreter
- T1083 File and Directory Discovery
- T1115 Clipboard Data
- T1027.009 Obfuscated Files or Information
- T1010 Application Window Discovery

## Sources

- [MALFEX - A malicious npm postinstall no advisory has caught for fourteen months (CloudSEK)](https://www.cloudsek.com/blog/malfex-malicious-npm-postinstall-supply-chain-campaign)
- [CloudSEK MALFEX full report (PDF)](https://cdn.cloudsek.com/cloudsek-blog-pdfs/malfex-a-mal-wd8.pdf)
- [OSV MAL-2026-17216: Malicious code in img-to-native (npm)](https://osv.dev/vulnerability/MAL-2026-17216)
- [OSV MAL-2026-17218: Malicious code in native-runner (npm)](https://osv.dev/vulnerability/MAL-2026-17218)
- [GHSA-pv7p-ghgv-268x (img-to-native)](https://github.com/advisories/GHSA-pv7p-ghgv-268x)
- [GHSA-jxw5-69p3-hpm4 (native-runner)](https://github.com/advisories/GHSA-jxw5-69p3-hpm4)
- [Jamf Threat Labs: Fake Zoom installer uses .NET downloader to deliver Overlord RAT on macOS](https://www.jamf.com/blog/fake-zoom-installer-delivers-overlord-rat-macos/)
- [Overlord RAT threat profile](https://www.iru.com/threats/overlord-rat)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2801