Malfex npm Malware Hides Executables in PNG Files to Infect Windows Devs

Key Takeaways

• A sophisticated npm malware campaign, dubbed MALFEX, is targeting Windows developers.
• The attackers use novel methods, including embedding malicious executables within PNG image files, to deliver remote access tools and information stealers.
• The campaign leverages multiple npm packages and three distinct infection chains, making detection challenging.
• Over 40,000 downloads of malicious packages have been recorded, indicating a broad reach among developers.
• Defenders must implement robust supply chain security measures and scrutinize package dependencies beyond basic advisory checks.

MALFEX Campaign Targets Windows Developers with Advanced Malware

A persistent and complex npm malware operation, identified as MALFEX, is actively compromising Windows development environments. This campaign deploys remote access Trojans (RATs), data exfiltration tools, and stealthy downloaders using an array of deceptive techniques, prominently featuring the embedding of executable code within seemingly innocuous PNG image files.

The attackers have utilized eight distinct malicious npm packages and three unique infection vectors since August 2023. By October 1, 2026, these packages collectively amassed 40,767 downloads, with 3,017 occurring in the week prior. It is important to note that download figures reflect package reach and do not directly translate to confirmed infections, as they include factors like repeated installations, dependency pulls, and systems incompatible with the Windows-specific payloads.

Checkmarx researchers identified the campaign in a report released on October 5. Their analysis linked twelve npm packages to a single operator, with four of these packages serving as benign cover for the malicious activity. The “MALFEX” moniker was consistently found across publisher accounts, repository metadata, package documentation, and even embedded in the image decryption key, suggesting a deliberate branding by the threat actor.

Sophisticated Delivery: Executables in PNGs

The MALFEX campaign employs several sophisticated delivery mechanisms, with the most notable involving the concealment of executables within image files.

Method 1: PNG-Disguised Executables and Overlord RAT

The initial infection vector involves three npm packages that execute hidden scripts either during or immediately after installation. These scripts retrieve a file served with an `image/png` content type, save it as a Windows executable, and then launch it. Despite the `image/png` label, the downloaded file is not a standard PNG but a Microsoft IExpress archive. Within this archive, a digitally signed AutoIt interpreter executes an encrypted script.

Through a multi-stage decoding process involving XOR, RC4, and LZNT1 compression, the script ultimately deploys the Overlord RAT. Code analysis revealed instructions for the RAT to inject itself into a legitimate, signed Windows process, attempting to mask its parent process as Explorer. However, this specific injection behavior was not observed during runtime testing by researchers.

Method 2: Encrypted Payloads Appended to Genuine PNGs

A second, distinct infection chain utilizes three different npm packages. This method fetches a legitimate PNG image that has encrypted executable data appended after its end-of-file marker. The malware then extracts this appended data and decrypts it using AES. The decrypted payload is a Go-based downloader, which subsequently retrieves “movinlike,” a 64 MB Node.js information stealer packaged as a Windows executable.

A critical aspect of this second method is that the malicious chain activates when the package is *loaded*, not through an install script. This distinction is significant because it bypasses security measures that disable npm lifecycle scripts, making it harder to prevent. This technique echoes previous npm attacks where RATs were hidden in PNGs, though those earlier campaigns typically embedded payloads within image pixels rather than appending them.

Method 3: ASCII Art Downloader

The third delivery path involves a downloader concealed within an ASCII art npm package. This downloader is triggered by a specific font value, with malicious code strategically placed beyond visible editor windows using extended sequences of spaces. Download failures are silently ignored. The latest analyzed payload for this specific chain was unavailable, and Checkmarx found no direct link between this downloader and the “movinlike” stealer.

Malware Capabilities: Remote Control, Account Theft, and Stealth

The payloads delivered by MALFEX are designed for extensive control and data exfiltration.

The Overlord RAT offers comprehensive remote control capabilities, including screen capture, keystroke logging, clipboard data collection, file system searches, and the execution of arbitrary remote commands. It also features a hidden desktop function. For persistence, its loader creates a scheduled task, named `Maiden`, configured to run every five minutes with a backdated start date of January 1, 2020. This tactic is designed to evade detection by security tools that only monitor registry startup keys.

The RAT can theoretically retrieve command-and-control (C2) server addresses from encrypted Solana transaction memos. However, the analyzed sample lacked a configured Solana address or server list, and researchers observed no C2 traffic, indicating this capability may not have been active in the tested infection.

The “movinlike” information stealer is highly focused on credential and session theft. It targets Discord tokens, browser cookies, saved browser passwords, Telegram sessions, and various cryptocurrency wallets. It achieves this by modifying Discord startup scripts, collecting account details, and transmitting stolen data in compressed chunks to a Discord webhook. This highlights the critical need for rigorous security checks of developer package installations, especially given past incidents like the StegaBin campaign.

Mitigation Challenges and Recommendations

As of Checkmarx’s October 1 snapshot, three malicious packages remained installable, with two lacking any malware advisories. Furthermore, one advisory only covered two of four malicious versions for a particular package. This indicates that organizations relying solely on advisory feeds may miss known compromised code.

What You Should Do

• Inspect Dependencies Thoroughly: Implement automated tools and manual review processes to scrutinize dependency trees, lockfiles, and package caches for any suspicious or unknown packages, particularly those with low download counts or recent publication dates.
• Isolate and Preserve: If an affected package is discovered, immediately isolate the compromised host. Preserve system images and logs for forensic analysis.
• Remove Persistence: Identify and remove all forms of persistence established by the malware, including scheduled tasks (e.g., `Maiden`), modified startup scripts, and any dropped executables.
• Reset Credentials: Change all exposed passwords from a clean, uncompromised system. This includes developer accounts, version control systems, and any services accessed from the infected environment.
• Secure Messaging and Crypto: End all active Telegram sessions and transfer any cryptocurrency funds from exposed wallets to new, secure wallets.
• Block Malicious Indicators: Implement network blocks for the specific malicious package versions, URLs, and hosts identified in the IoCs section, being careful not to block entire shared hosting services.
• Review Internal Registries: Audit internal npm registries and mirrors to ensure no malicious copies of these packages are present, preventing re-infection.
• Monitor Account Activity: Continuously monitor developer account activity for unusual logins or actions that could indicate compromise.

Indicators of Compromise (IoCs)

Note that [email protected] is explicitly identified as not malicious by Checkmarx.

URLs and Hosts

Both HTTP and HTTPS variants of the listed IP addresses and domains were observed. It is advised to block specific malicious paths rather than entire shared service domains.

SHA-256 Hashes

Note that movinlike can be readily recompiled, so hash checks should be complemented by broader file, task, and network analysis. The signed AutoIt interpreter is legitimate software; its presence alone does not confirm infection without further contextual evidence.

Host Artifacts and Persistence

Supporting Attribution Indicators

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.