# MALFEX npm Campaign: 'imgdecode' Native Addon Hides DLL Shellcode Loader and Infostealer/RAT Chain

> The long-running MALFEX operator published malicious npm packages, led by imgdecode (1.0.0-1.0.3), that ship a precompiled Windows .node addon which downloads an AES-encrypted payload from GitHub and injects it into dllhost.exe. The chain ends in a stealer/RAT that harvests browser, Discord, Telegram, crypto-wallet and gaming credentials and talks to a WebSocket C2 at 104.234.65.75:7007.

- **Published:** 2026-10-17T12:01:40Z
- **Last reviewed:** 2026-10-17T12:01:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3799
- **ID:** TL-2026-3799
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** MALFEX
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MALFEX is an npm supply-chain campaign that Checkmarx and CloudSEK link to a single operator who has published to the registry since August 2023 (campaign start cited as 2023-08-06). Checkmarx counts 12 packages tied to the operator: eight malicious and four benign cover packages (function-ascii, malfapi, malfex-webhook-node, centralizemiddle). Malicious packages are function-flag and function-color (postinstall downloaders; function-flag has been malicious since 2025-07-18 with roughly 37,000 lifetime downloads), cdn-img-fetch, img-to-native and native-runner (stealer chain), the Overlord RAT loaders tlxbnhd, tldriver and mxdriver, and the newer imgdecode, imgbundle and runhelper. Checkmarx recorded 40,767 lifetime downloads across the earlier malicious set as of 2026-10-01; imgdecode had 979 downloads at the time of The Hacker News report (2026-10-17). Publisher accounts are malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4 and (for imgdecode) malfexteste8. The operator signs the work: the shared key string 'malfexteam2027', README text crediting the 'Malfex team' (Portuguese-language, owner named 'Murizada'), and a GitHub account 'cavecrew' with commits at UTC-3.

imgdecode (published 2026-09-30, 1.0.3 on 2026-10-11) is a nine-line JavaScript file that loads a precompiled 64-bit MSVC DLL, imgdecode.node, with no binding.gyp or native source. Because the logic runs during N-API module initialization, no npm install script is needed; code executes on require(). SafeDep reports the DLL first calls GetStdHandle/GetConsoleMode and returns silently unless stdout is an interactive terminal, which skips CI/CD and automated sandboxes. It then fetches https://raw.githubusercontent.com/cavecrew/proj/main/banner.jpg (the URL is XOR 0x37-encoded in the DLL), treats the first 16 bytes as an IV, decrypts the rest with AES-256-CBC using the SHA-256 of the passphrase 'nif-runtime-2027', and injects the shellcode into dllhost.exe via VirtualAllocEx, WriteProcessMemory, VirtualProtectEx and CreateRemoteThread, falling back to in-process execution in node.exe if remote injection fails. In the earlier chain, cdn-img-fetch/img-to-native decode a PNG/JPG polyglot (key 'malfexteam2027'), with image-signature checks acting as a kill switch, and drop a Go downloader that retrieves the 'movinlike' stealer (setup.exe) from 104.234.65.75:700.

The stage-3 stealer audits for virtual machines, sandbox user accounts and analysis tools (x64dbg, procmon, Wireshark) before harvesting Chromium-browser passwords and cookies, Discord tokens (with client injection and webhook patching), Telegram Desktop tdata, crypto-wallet extensions and desktop wallets, gaming-platform sessions (Steam, Epic, Riot, Battle.net, Minecraft, Ubisoft), and files matching seed/mnemonic/wallet/secret/token/senha plus .kdbx, .pem, .ppk and .env. Data is zipped, split into 25 MB chunks and posted to a Discord webhook. It persists by copying itself to %APPDATA%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe and creating a Registry Run value and scheduled task both named MicrosoftEdgeUpdateService. It also connects to ws://104.234.65.75:7007/agent?license=... (embedded MALFEX license key, suggesting a malware-as-a-service model) for shell execution, file transfer, process control, clipboard access, screenshots and mouse/keyboard input. SafeDep further reports it edits Security and Sysmon EVTX logs (recalculating checksums) and deletes the PowerShell history file.

A parallel 'Arm A' delivers the Overlord Go RAT: a PNG from api.imghippo.com holding an IExpress cabinet, a signed AutoIt3.exe and an encrypted .a3x script, installed under %LOCALAPPDATA%\ScopeSmart Technologies Inc\ with a backdated scheduled task '\Maiden' running every five minutes. Overlord hollows TapiUnattend.exe under a spoofed explorer.exe parent and resolves C2 from encrypted Solana blockchain transaction memos; the analyzed build had no Solana address configured. Earlier function-flag versions fetched payloads (node.exe, svchost.exe, malfex.exe, nocry.exe) from Discord-CDN-style hosts and raw IPs. Sourcing caveat: the Hacker News article, Checkmarx, CloudSEK and SafeDep were read; no CVE or CVSS applies, and Checkmarx's MITRE list contains some questionable mappings that were not adopted. Overlord RAT C2 traffic was not observed by the analysts.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.007 JavaScript
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1685.005 Clear Windows Event Logs
- T1070.003 Clear Command History
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1113 Screen Capture
- T1056.001 Keylogging
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon](https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html)
- [SafeDep: MALFEX imgdecode npm native addon loader](https://safedep.io/malfex-imgdecode-npm-native-addon-loader/)
- [Checkmarx: malfex npm malware campaign - three payloads and an adversary that signs their work](https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/)
- [CloudSEK: MALFEX malicious npm postinstall supply chain campaign](https://www.cloudsek.com/ar/blog/malfex-malicious-npm-postinstall-supply-chain-campaign)
- [MALFEX npm Campaign: 8 Packages Trigger Malware on Install and Require](https://lilting.ch/en/articles/malfex-npm-overlord-stealer)
- [MALFEX - A malicious npm postinstall no advisory has caught for fourteen months](https://www.hendryadrian.com/malfex-a-malicious-npm-postinstall-no-advisory-has-caught-for-fourteen-months/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3799