DEV#POPPER npm Supply Chain RAT, SectopRAT Fake Claude Installers & 19-Extension Wallet Drainer: OTX Pulse Analysis — Blockchain C2 & Credential Theft Detection Pack | Security Arsenal

A cluster of five OTX pulses published in late August 2026 reveals a converging trend across the infostealer and credential-theft ecosystem: adversaries are moving C2 resolution and payload staging onto public blockchains while abusing trusted developer and consumer software supply chains for initial access. The common thread is credential and wallet theft executed through channels enterprise controls implicitly trust — npm registries, browser extension stores, malvertising-served installers hosted on legitimate vendor infrastructure, and mobile apps impersonating government agencies.

The highest-priority activity for enterprise defenders:

DEV#POPPER / OmniStealer via compromised @joyfill npm beta releases — an import-time JavaScript implant retrieves encrypted payloads by reading transactions on the Tron, Aptos, and BNB Smart Chain networks, then drops a 77 KB Node.js remote access trojan controlled over Socket.IO. Any developer workstation or CI runner that installed the poisoned beta versions is a potential intrusion pivot.
SectopRAT via trojanized Claude Desktop installers — Bing malvertising funnels victims to fake installers hosted on legitimate Anthropic infrastructure. The chain uses DLL sideloading through a Java Chromium Embedded Framework component, EtherHiding-style blockchain C2, and scheduled task persistence. The fake installer lure targets exactly the AI-tool-adopting developer population already exposed by the npm campaign.
19 Chrome/Edge extensions deploying a wallet drainer framework — extensions strip Content Security Policy headers, inject XSS payloads, and exfiltrate cryptocurrency wallet secrets over WebSocket C2. Credential harvesting from browsers is the secondary objective.
Flying Eagle Android RAT ecosystem (170 active servers) — a fractured criminal operation in China/Thailand running SpyNote/BTMOB-family mobile RATs against banking customers, with leaked source code and ~200 stolen customer databases fueling downstream fraud. A successor platform, Night Dragon, is already emerging.
Dysphoria botnet (200,000+ hosts) — IoT-focused botnet exploiting a dozen router/device CVEs, using ENS/SNS blockchain domains for C2 and converting victims into relay/proxy nodes that will anonymize follow-on credential-theft traffic.

Collectively, these pulses describe a maturing blockchain-anchored C2 paradigm: EtherHiding-style techniques make takedowns ineffective, because payload locations are encoded in immutable, replicated ledger transactions. The objective across all five pulses is the same — harvest credentials, session material, and wallet secrets at scale, with developer machines and financial-sector end users as the primary targets.

Threat Actor / Malware Profile

DEV#POPPER (npm supply chain RAT)

Distribution: Compromised beta releases in the legitimate @joyfill npm namespace. The implant executes at import time — merely requiring the package in a build or test triggers infection, meaning CI/CD pipelines are infected without any developer action.
Payload behavior: A 77 KB Node.js RAT providing remote command execution, file upload, and arbitrary file read. OmniStealer components harvest browser credentials, cookies, and crypto wallet data.
C2 communication: Two-stage — encrypted payload coordinates are retrieved from blockchain transactions on Tron, Aptos, and BNB Smart Chain (making infrastructure takedown-resistant), then live control runs over Socket.IO (WebSocket) connections.
Persistence: Developer-context persistence via npm lifecycle hooks and node_modules re-infection; watch for unexpected postinstall/preinstall scripts.
Anti-analysis: Payloads are encrypted until retrieved on-chain; blockchain indirection defeats static IOC blocking of payload hosts.

SectopRAT (FakeAgent campaign)

Distribution: Bing malvertising → trojanized Claude Desktop installer hosted on legitimate Anthropic infrastructure (abusing trust in signed, well-known domains).
Payload behavior: DLL sideloading through a Java Chromium Embedded Framework (JCEF) component; full RAT capability including screen control and credential access.
C2 communication: EtherHiding-style blockchain C2 resolution, plus fallback infrastructure (e.g., domain neeitoerw.my, IP 153.75.84.173).
Persistence: Masqueraded scheduled tasks — the exact artifact that triggered the documented ten-minute MXDR containment.
Anti-analysis: Living-off-trusted-installer staging, sideloaded DLLs evading application allowlisting, blockchain-based config rotation.

Chrome/Edge Wallet Drainer Framework (19 extensions)

Distribution: Extensions published to official Chrome Web Store and Edge Add-ons over the last six months, disguised as analytics, crypto price, and utility tools.
Payload behavior: Strips CSP headers, performs XSS injection into visited pages, steals wallet secrets/seed phrases and browser credentials.
C2 communication: Persistent WebSocket channels to domains such as cookie-whitelist.com, whale-alert.life, api.extensionanalyticspro.top, blockfolioaddressmonitor.pro, and lookalike domain ggle-analytics.com.

Flying Eagle / Night Dragon (Android RAT)

Distribution: Malicious APKs impersonating a Chinese Provincial Public Security Bureau app; Telegram channels used for sales and distribution (e.g., lure domain 110gongan.com).
Payload behavior: SpyNote/BTMOB-lineage RAT — SMS interception, banking overlay credential theft, keylogging, remote device control.
C2 communication: ~170 active servers; source code leak (early 2026) plus ~200 stolen customer databases enable copycat operators; successor platform Night Dragon under active development.

Dysphoria Botnet

Distribution: IoT exploitation across CVE-2013-3307, CVE-2016-20016, CVE-2017-5259, CVE-2017-17215, CVE-2018-14558, CVE-2020-8515, CVE-2020-25499, CVE-2022-35733 — heavily weighted toward unpatched routers and embedded devices, predominantly in China.
C2 communication: ENS and SNS blockchain domains for C2 resolution; novel relay architecture converts victims into proxy nodes, laundering downstream attack traffic.

IOC Analysis

The pulse indicators break down into four operational classes:

File hashes (SHA256/SHA1/MD5): The DEV#POPPER pulse carries 8 SHA256s covering the poisoned npm package tarballs and the 77 KB RAT payload; Flying Eagle carries MD5/SHA1 APK hashes. Load all hashes into your EDR blocklist and retrospective scan (most enterprise EDRs support hash-only blocking; for npm, grep package-lock.json and npm ls output across the build fleet).
Domains/hostnames: 110gongan.com, neeitoerw.my, cookie-whitelist.com, whale-alert.life, api.extensionanalyticspro.top, blockfolioaddressmonitor.pro, cryptopricebadgequickglance.pro, ggle-analytics.com. Sinkhole at DNS, add to proxy block categories, and hunt 90 days of DNS logs — note that blockchain-resolved C2 means new domains will appear continuously, so behavioral detection (WebSocket beaconing, blockchain RPC lookups from Node processes) is essential.
IPv4: 153.75.84.173 (SectopRAT C2). Block at egress, hunt NetFlow/firewall logs.
URLs: http://api.active-enable-right-click.top/?uuid= (extension check-in with victim UUID) and http://ggle-analytics.com/ (typosquatted exfil). The ?uuid= parameter is a strong regex hunting artifact in proxy logs.
CVEs: The eight Dysphoria CVEs should be run against your internet-facing device inventory immediately — any match is a likely botnet relay node on your network.

Tooling guidance: ingest the OTX pulses directly via the OTX DirectConnect API or your TIP (MISP/OpenCTI both have native OTX connectors). Use Socket, npm audit signatures, or ossf/package-analysis for npm artifact verification; Etherscan/Tronscan APIs can decode the blockchain transaction payloads if you need to preemptively resolve rotated C2 addresses.

Detection Engineering

YAML

---
title: Node.js Process Initiating Outbound WebSocket or Blockchain RPC Connection
id: 7c1a2f4e-9b3d-4e6a-a1c2-d5f8e9a0b1c2
status: experimental
description: Detects node.exe/node processes establishing outbound connections consistent with DEV#POPPER RAT Socket.IO C2 or blockchain-based payload retrieval (Tron/Aptos/BSC RPC endpoints) from OTX pulse 2026-08.
author: Security Arsenal Threat Intel
references:
  - https://socket.dev/blog/joyfill-npm-beta-releases-compromised
date: 2026/08/28
logsource:
  category: network_connection
  product: windows
selection_image:
  Image|endswith:
    - '\node.exe'
    - '\nodejs.exe'
selection_ports:
  DestinationPort:
    - 443
    - 8545
    - 8899
    - 3000
    - 8080
filter_common:
  DestinationHostname|endswith:
    - 'npmjs.org'
    - 'npmjs.com'
    - 'github.com'
    - 'microsoft.com'
condition: selection_image and selection_ports and not filter_common
falsepositives:
  - Legitimate developer tooling (npm, yarn, webpack dev servers) making outbound calls
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1105
---
title: Suspicious Scheduled Task Masquerading as Application Updater
id: 3e8b5d1c-2a4f-4c7b-b9e0-f1a2b3c4d5e6
status: experimental
description: Detects scheduled task creation with names masquerading as legitimate application updaters (Claude/Desktop/Update patterns) executing non-standard binaries, matching SectopRAT FakeAgent persistence from OTX pulse 2026-08.
author: Security Arsenal Threat Intel
references:
  - https://www.cyberproof.com/blog/ten-minutes-to-containment-how-agentic-mxdr-scoped-a-fake-claude-desktop-intrusion/
date: 2026/08/28
logsource:
  category: process_creation
  product: windows
selection_schtasks:
  Image|endswith: '\schtasks.exe'
  CommandLine|contains:
    - '/create'
selection_names:
  CommandLine|contains:
    - 'Claude'
    - 'DesktopUpdate'
    - 'AppUpdate'
    - 'UpdaterService'
selection_suspicious_path:
  CommandLine|contains:
    - '\AppData\'
    - '\Temp\'
    - '\ProgramData\'
    - 'jcef'
    - 'chrome_elf'
condition: selection_schtasks and selection_names and selection_suspicious_path
falsepositives:
  - Legitimate application auto-updaters registering tasks in user profile paths
level: high
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.t1036
---
title: DLL Sideloading via JCEF or Chromium Embedded Framework Binary
id: 9f2c6a3d-1e5b-4d8c-c7f1-a2b3c4d5e6f7
status: experimental
description: Detects DLL load of chrome_elf.dll or JCEF-related libraries from non-standard paths, consistent with SectopRAT FakeAgent DLL sideloading technique in trojanized Claude Desktop installers.
author: Security Arsenal Threat Intel
references:
  - https://www.cyberproof.com/blog/ten-minutes-to-containment-how-agentic-mxdr-scoped-a-fake-claude-desktop-intrusion/
date: 2026/08/28
logsource:
  category: image_load
  product: windows
selection:
  ImageLoaded|contains:
    - 'chrome_elf.dll'
    - 'jcef_helper'
    - 'libcef.dll'
filter_legit:
  ImageLoaded|startswith:
    - 'C:\Program Files\Google\Chrome\'
    - 'C:\Program Files (x86)\Microsoft\Edge\'
    - 'C:\Program Files\Microsoft\Edge\'
condition: selection and not filter_legit
falsepositives:
  - Legitimate Electron or CEF-based applications installed outside standard paths
level: medium
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.persistence

KQL — Microsoft Sentinel / Defender

// SectopRAT + Wallet Drainer: C2 beaconing, IOC matching, and suspicious npm/node network activity
let MaliciousDomains = dynamic(["neeitoerw.my","cookie-whitelist.com","whale-alert.life","api.extensionanalyticspro.top","blockfolioaddressmonitor.pro","cryptopricebadgequickglance.pro","ggle-analytics.com","cookie-whitelist.top","active-enable-right-click.top","110gongan.com"]);
let MaliciousIPs = dynamic(["153.75.84.173"]);
let DomainHits = DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl in~ (MaliciousDomains) or RemoteIP in (MaliciousIPs)
| project HitType="KnownIOC", TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
let NodeWebsocket = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("node.exe","nodejs.exe","npm.exe","npm.cmd")
| where RemotePort in (443, 8545, 8899, 3000, 8080)
| where not(RemoteUrl has_any ("npmjs.org","npmjs.com","github.com","githubusercontent.com","microsoft.com","azure.com"))
| summarize ConnectionCount=count(), Ports=make_set(RemotePort), Destinations=make_set(RemoteUrl) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(TimeGenerated, 1h)
| project HitType="NodeOutboundAnomaly", TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl=tostring(Destinations), ConnectionCount;
union DomainHits, NodeWebsocket
| sort by TimeGenerated desc

PowerShell

# OTX 2026-08 Hunt: SectopRAT persistence + DEV#POPPER npm artifacts + extension drainer
# Run elevated across endpoints via your RMM/EDR remote shell

$Report = @()

# 1. Scheduled tasks masquerading as updaters running from user/temp paths (SectopRAT)
$suspTasks = Get-ScheduledTask | ForEach-Object {
    $task = $_
    $task.Actions | Where-Object {
        $_.Execute -match 'AppData|Temp|ProgramData' -and
        $task.TaskName -match 'Claude|Update|Updater|Desktop|App'
    } | ForEach-Object {
        [PSCustomObject]@{
            Finding = 'SuspiciousScheduledTask'
            TaskName = $task.TaskName
            TaskPath = $task.TaskPath
            Action = $_.Execute
            Args   = $_.Arguments
        }
    }
}
$Report += $suspTasks

# 2. Sideloaded CEF/JCEF DLLs outside standard browser paths
$cefDlls = @()
foreach ($root in @("$env:LOCALAPPDATA", "$env:APPDATA", "$env:TEMP", "C:\ProgramData")) {
    if (Test-Path $root) {
        $cefDlls += Get-ChildItem -Path $root -Recurse -Include 'chrome_elf.dll','libcef.dll','jcef*.dll' -ErrorAction SilentlyContinue | Select-Object -First 50
    }
}
$Report += $cefDlls | ForEach-Object {
    [PSCustomObject]@{ Finding='SideloadedCEFDLL'; TaskName=''; TaskPath=$_.FullName; Action=''; Args='' }
}

# 3. DEV#POPPER: scan for poisoned npm package artifacts in node_modules and npm cache
$devpopperHashes = @('2cfede38fb121a71a2f3607474aa8cd588a99f51b37e5e6f0d8cb789fa275032','26351aed0397158d3a3b8cc8fd3047d4c015d264c9895f10f20f1521b974ed18','36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c','adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6','8e8b90dedd456ded0c5748119836e1ca1066112bc569c1b41ca70eb931d1d4dc','5f6a92006ca2ea4b464d66fb41af777edce7296939a7c6ee491e2b3cbfe09848','bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17','1352ad22c99983d91e600348b7cbf58235131b1ee34cea9f09623206d5b7dea7')
$joyfillPaths = @("$env:APPDATA\npm-cache", "$env:LOCALAPPDATA\npm-cache", ".\node_modules\@joyfill")
foreach ($p in $joyfillPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($h -and ($devpopperHashes -contains $h.ToLower())) {
                $Report += [PSCustomObject]@{ Finding='DEVPOPPER_HASH_MATCH'; TaskName=''; TaskPath=$_.FullName; Action=$h; Args='' }
            }
        }
    }
}

# 4. Active connections to known C2 (SectopRAT / wallet drainer)
$c2 = @('153.75.84.173')
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $c2 -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $Report += [PSCustomObject]@{ Finding='ActiveC2Connection'; TaskName=$proc.ProcessName; TaskPath=$proc.Path; Action=$_.RemoteAddress; Args=$_.RemotePort }
}

# 5. Wallet drainer extensions: check Chrome/Edge extension prefs for known-bad extension hosts
$extDirs = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions", "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions")
$badExtDomains = 'cookie-whitelist|whale-alert|extensionanalyticspro|blockfolioaddressmonitor|cryptopricebadgequickglance|ggle-analytics'
foreach ($d in $extDirs) {
    if (Test-Path $d) {
        Get-ChildItem $d -Directory | ForEach-Object {
            $manifest = Get-ChildItem $_.FullName -Recurse -Filter manifest.json -ErrorAction SilentlyContinue | Select-Object -First 1
            if ($manifest -and (Get-Content $manifest.FullName -Raw) -match $badExtDomains) {
                $Report += [PSCustomObject]@{ Finding='MaliciousBrowserExtension'; TaskName=$_.Name; TaskPath=$manifest.FullName; Action=''; Args='' }
            }
        }
    }
}

if ($Report.Count -gt 0) { $Report | Format-List; $Report | Export-Csv "$env:TEMP\otx_hunt_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation }
else { Write-Output "[+] No OTX 2026-08 artifacts found on $env:COMPUTERNAME" }

Response Priorities

Immediate (0–4 hours):

Block all pulse IOCs at DNS sinkhole, web proxy, and egress firewall: the nine extension/drainer domains, neeitoerw.my, 110gongan.com, and IP 153.75.84.173. Add the extension check-in URL pattern ?uuid= to proxy alerting.
Push all DEV#POPPER SHA256 hashes and Flying Eagle APK hashes to EDR blocklists with retrospective scanning enabled.
Query the software asset inventory and CI/CD artifact logs for any installation of @joyfill beta releases — treat every hit as a confirmed intrusion, not a vulnerability.
Force-remove the 19 flagged browser extensions via enterprise browser policy (Chrome ExtensionInstallBlocklist / Edge equivalent) and audit extension inventories fleet-wide.

24 hours:

Credential rotation: Because every campaign in this set steals credentials or wallet secrets, force password resets and revoke active sessions/tokens for any user whose device shows IOC hits — including npm tokens, cloud CLI credentials, and SSH keys stored on developer machines (DEV#POPPER reads arbitrary files).
Invalidate browser session cookies for affected users (session theft bypasses MFA); review IdP sign-in logs for anomalous token replay.
For any crypto-wallet exposure (wallet drainer hits), treat funds as compromised and rotate to newly generated wallets.
Audit scheduled tasks and JCEF/CEF DLL loads across the fleet using the hunt script above; isolate any host with hits.

1 week:

npm supply-chain hardening: pin dependencies, enforce lockfile integrity in CI, deploy a private registry proxy (e.g., Artifact Registry / Nexus) with malware scanning, and block install-time script execution (--ignore-scripts) in build pipelines by default.
Egress control: alert on Node.js/browser-extension WebSocket connections to non-allowlisted destinations; consider blocking or proxying outbound calls to public blockchain RPC endpoints from non-blockchain workloads — this neutralizes EtherHiding-style resolution for Tron/Aptos/BSC and ENS/SNS lookups.
Patch IoT/edge devices against the eight Dysphoria CVEs and segment IoT from production networks to prevent relay-node conversion.
Installer governance: enforce application allowlisting and restrict software installs to a curated internal store to blunt malvertising-delivered trojanized installers like the fake Claude Desktop.
Mobile: enforce MDM sideloading restrictions for APAC-facing staff and block the 110gongan.com lure infrastructure.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

DEV#POPPER npm Supply Chain RAT, SectopRAT Fake Claude Installers & 19-Extension Wallet Drainer: OTX Pulse Analysis — Blockchain C2 & Credential Theft Detection Pack