WEL1DROPPER cross-platform RAT and infostealer delivery chain
Malware Activity
Summary
Hide ▲
Show ▼
The WEL1DROPPER malware chain is delivering RAT and infostealer payloads through nearly 800 malicious npm packages, expanding cross-platform risk for Windows, macOS, and Linux systems. The packages use a README-driven require() path to trigger the loader, which fingerprints the host and retrieves a matching payload from Cloudflare Workers or fallback wel1[.]ru domains. On Windows, the final stage includes ETW/AMSI patching, sandbox checks, and persistence via a Registry Run key and scheduled task. On Linux, the chain can deploy Sliver, an open-source C2 framework, showing the loader is part of a broader malicious distribution operation.
Related Happenings
Flooding Dropper malicious npm package campaign targeting Windows, Mac, and Linux
Campaign
H score44
First: 07.08.2026 21:48
Last: 07.08.2026 21:48
Sources 1
How related:
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems.
About this happening:
A new npm supply-chain campaign has published nearly 800 malicious packages to push RAT and infostealer payloads onto Windows, Mac, and Linux systems. The packages...
Flooding Dropper malicious npm package campaign targeting Windows, Mac, and Linux
CampaignHow related: A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems.
About this happening: A new npm supply-chain campaign has published nearly 800 malicious packages to push RAT and infostealer payloads onto Windows, Mac, and Linux systems. The packages...
Silver Fox MODBEACON Rust RAT activity
Malware Activity
H score23
First: 10.07.2026 16:15
Last: 10.07.2026 16:15
Sources 1
About this happening:
The Silver Fox ecosystem has been tied to MODBEACON, a Rust-based remote access trojan that gives operators encrypted C2 and modular control over infected hosts. T...
Silver Fox MODBEACON Rust RAT activity
Malware ActivityAbout this happening: The Silver Fox ecosystem has been tied to MODBEACON, a Rust-based remote access trojan that gives operators encrypted C2 and modular control over infected hosts. T...
Rollup polyfill npm package malware activity for remote access and data theft
Malware Activity
H score16
First: 03.07.2026 19:07
Last: 03.07.2026 19:07
Sources 1
About this happening:
Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Rollup polyfill npm package malware activity for remote access and data theft
Malware ActivityAbout this happening: Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Atomic-lockfile rootkit-infostealer distribution through AUR packages
Malware Activity
H score3
First: 12.06.2026 20:03
Last: 12.06.2026 20:03
Sources 1
About this happening:
AUR packages are distributing the atomic-lockfile Linux rootkit and infostealer through compromised build scripts, with more than 400 packages reported and the o...
Atomic-lockfile rootkit-infostealer distribution through AUR packages
Malware ActivityAbout this happening: AUR packages are distributing the atomic-lockfile Linux rootkit and infostealer through compromised build scripts, with more than 400 packages reported and the o...
SPECTRALVIPER DLL sideloading backdoor activity
Malware Activity
H score31
First: 11.06.2026 12:45
Last: 11.06.2026 12:45
Sources 1
About this happening:
The SPECTRALVIPER backdoor was executed on affected Windows hosts through a DLL sideloading chain during October 2025 to March 2026, giving operators a way to run...
SPECTRALVIPER DLL sideloading backdoor activity
Malware ActivityAbout this happening: The SPECTRALVIPER backdoor was executed on affected Windows hosts through a DLL sideloading chain during October 2025 to March 2026, giving operators a way to run...
Timeline
-
07.08.2026 21:48 2 articles · 2h ago
Nearly 800 malicious npm packages deliver WEL1DROPPER payloads
Initial DisclosureA cluster of nearly 800 malicious npm packages is published to the npm registry in a supply-chain campaign that uses a README-instructed require() path to launch WEL1DROPPER, identify the host operating system and processor architecture, and fetch a compatible payload from Cloudflare Workers or wel1[.]ru. The chain delivers RAT and infostealer functionality across Windows, macOS, and Linux; the Windows stage patches ETW and AMSI, checks for sandboxes and virtual environments, and establishes persistence, while the Linux stage can deploy Sliver, and the macOS payload includes domain references that suggest possible targeting of Russian financial institutions and mobile payments.
Show sources
- Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — thehackernews.com — 07.08.2026 21:48
- Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — thehackernews.com — 07.08.2026 21:48