MALFEX Campaign Escalates: New Malicious ‘imgdecode’ Package Discovered Targeting Windows Systems via npm Registry

For instance, when the "native-runner" package was flagged, the actor introduced "runhelper" and "imgbundle." On the same day these replacements appeared, the first version of "imgdecode" was also released. This rapid-response cycle indicates a dedicated adversary who is actively monitoring the security industry’s reaction to their work.

The campaign utilizes several distinct infection pathways. Of the eight primary packages identified by researchers, three functioned as loaders for the Overlord Remote Access Trojan (RAT). Three others, including "cdn-img-fetch" and "img-to-native," worked in tandem to download and execute a Node.js-based credential stealer. A third, more traditional pathway involved the use of post-install hooks—scripts that run automatically when a package is installed—to contact external servers and retrieve next-stage binaries.

The "imgdecode" package represents a further refinement of these tactics. In its latest iteration, version 1.0.3, the package has become entirely self-contained. Earlier versions (1.0.1 and 1.0.2) required the presence of another MALFEX package, "imgbundle," to function. However, the developer eventually removed this dependency, allowing "imgdecode" to operate as a standalone threat, thereby reducing the "noise" created by multiple package installations and making the attack harder to track.

Advanced Evasion and Anti-Analysis

The MALFEX operator has integrated several sophisticated anti-analysis techniques into their binaries. The DLL used in the "imgdecode" chain includes a check to determine if it is running within a developer’s terminal or a controlled analysis environment. If it detects the presence of virtual machines, sandboxes, or common security tools such as Process Monitor and Wireshark, it may alter its behavior or cease execution entirely to avoid being caught by researchers.

Furthermore, the malware employs a clever "kill switch" mechanism. After decrypting the payload fetched from GitHub, the DLL checks the first few bytes of the plaintext. If these bytes match the file signature of a legitimate JPEG or PNG image, the DLL terminates its operation. This suggests that the operator can effectively "turn off" the infection chain remotely by simply replacing the malicious encrypted file on GitHub with a standard image file. If the decryption yields a valid image instead of shellcode, the loader assumes the campaign is paused or completed and stops the injection process.

Impact and Payload Capabilities

The ultimate goal of the MALFEX campaign appears to be comprehensive data theft and system control. The Node.js stealer deployed in these attacks is particularly aggressive. It is designed to harvest a wide array of sensitive information, including:

• Cryptocurrency Assets: The malware searches for seed phrases and wallet data, specifically targeting files with extensions like .kdbx, .pem, and .ppk.
• Browser Data: It extracts saved passwords, cookies, and autofill information from Chromium-based web browsers.
• Communication Platforms: Data is harvested from Discord and Telegram accounts.
• Gaming Accounts: The stealer targets credentials and session data from platforms including Steam, Epic Games, Riot Games, Battle.net, Minecraft, and Ubisoft.
• Development Environments: It scans for .env files, which often contain sensitive API keys, database credentials, and other secrets used in software development.

Beyond simple data theft, the malware establishes a WebSocket connection to a command-and-control (C2) server, identified in recent samples as "104.234.65[.]75." Through this connection, the attacker can issue real-time commands to the compromised system. These capabilities include executing shell commands, transferring files, controlling active processes, accessing the clipboard, taking screenshots, and even monitoring or hijacking mouse and keyboard input.