A new unnamed cross-platform malware component attributed to North Korean threat actors was delivered via a fake job interview coding challenge. The infection chain uses OS-specific stager scripts that create a hidden .vscode directory, download bootstrap scripts, and fetch a final payload (ghost.js/ghost.npl) that beacons to an unauthenticated C2 server at 141.94.148.39:1224. The C2 endpoint /api/checkStatus accepts victim registration without authentication, allowing mass fake-registration flooding for infrastructure takedown.
Node.js malware
3 posts
North Korea’s Crypt: Hunting Ghosts Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - Check Point Research JSCeal is a Node.js-based stealer delivered as compiled V8 bytecode that targets browser credentials, cryptocurrency wallets, and Telegram sessions. The malware implements a local HTTPS interception proxy with attacker-controlled certificate installation, modifies responses for cryptocurrency platforms, and uses Puppeteer to automate Google OAuth token theft. Check Point Research developed a static deobfuscation pipeline extending the View8 decompiler to recover readable pseudocode from the obfuscated V8 bytecode, enabling analysis of the malware's full capability set.
Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads Six npm packages were identified delivering a malicious Node.js loader that uses Ethereum blockchain transactions to resolve C2 infrastructure. Three packages were hijacked legitimate projects with malicious code appended to existing files, and three were newly published packages. The loader queries Ethereum RPC providers, decodes IPv4 addresses from transaction recipient addresses, and retrieves secondary payloads from HTTP endpoints. The activity is attributed to the DPRK-linked Contagious Interview campaign.
