Malware · 116 days ago

Plaintext Payloads Expose Cross-Platform Node Stealer

This stealer is easier to analyze than it looks. The wrapper is obfuscated, but the malicious payloads are embedded in plain text, so static review can still recover behavior and indicators without waiting for detonation.

SANS ISC identified a Node.js stealer targeting Windows via WSL, macOS, and Linux. The report says the code exfiltrates data with Axios to hxxp://216[.]126[.]225[.]243:8086/upload, which gives defenders a concrete network indicator and a workable file-based detection path across developer and endpoint environments.

Timeline

• May 22 Reported by SANS ISC

Sources

1 source covering this story

• SANS ISC May 22

  Cross-Platform NPM Stealer - SANS Internet Storm Center

  Cross-Platform NPM Stealer, Author: Xavier Mertens

Part of the PlainSec briefing for 2026-05-22

Editions

• Briefing for 2026-05-22

Related stories

• Kali365 Expands Beyond Microsoft 365 Tokens