Severity: High | Priority: 1
These GajAV signatures detect artefacts from MALFEX, a long-running npm supply-chain attack campaign. The operator, self-identified by the internal key string malfexteam2027, published at least twelve npm packages beginning in August 2023 and accumulated more than 40,767 downloads across eight confirmed malicious packages before discovery. The campaign runs three parallel delivery arms. The three Overlord signatures cover Arm A, used by packages tlxbnhd, tldriver, and mxdriver: a postinstall hook downloads a Windows PE file masquerading as a PNG image (LoaderPng) — in reality an IExpress self-extracting cabinet — which unpacks a signed AutoIt3 interpreter alongside an encrypted compiled AutoIt bytecode script (A3xScript); the script decrypts and process-injects Overlord RAT (Rat) into TapiUnattend.exe, with persistence set via a scheduled task named \Maiden. Overlord is an open-source Go-based remote-access trojan, initially documented by Jamf Threat Labs in August 2026, that resolves its command-and-control address from encrypted memos embedded in Solana blockchain transactions; its capabilities include screen capture, keylogging, clipboard monitoring, remote shell, and hidden-desktop control. These signatures cover Arms B and C, used by packages native-runner, img-to-native, cdn-img-fetch, function-flag, and function-color: index.js variants and postinstall or example.js trigger scripts retrieve PNG or JPG banner image files that carry an AES-encrypted Windows downloader appended beyond the image end-of-file marker; the downloader fetches and executes the movinlike Node.js stealer, which targets eight Discord clients for authentication token theft, harvests saved credentials and cookies from Chromium-based browsers, captures Telegram Desktop session data and cryptocurrency wallet files, then compresses and exfiltrates the collected material to a hardcoded Discord webhook in 25 MB chunks.
If any of these signatures alert on a system in your network, treat it as a confirmed npm supply-chain compromise. Immediately isolate the affected endpoint and identify which developer workstation or CI/CD pipeline ran npm install for one of the malicious packages during the infection window. Given that movinlike can exfiltrate credentials silently on first run, revoke all Discord tokens, browser-saved passwords and session cookies, Telegram session data, and cryptocurrency wallet seeds accessible from the compromised host without waiting for further confirmation. For Overlord RAT infections, hunt for the scheduled task \Maiden (which uses a backdated start time to evade timeline analysis), the file %APPDATA%\Microsoft\Windows\node_runtime_helper.exe, and the directory %LOCALAPPDATA%\ScopeSmart Technologies Inc\; terminate any injected TapiUnattend.exe process and remove these artefacts. Audit package.json and lockfiles across all affected repositories to confirm the malicious packages have been excised and replace them with vetted alternatives or remove unused dependencies. Rotate all secrets — API keys, signing certificates, service account tokens, and deployment credentials — that were present on affected systems during the infection window, as Overlord's remote-shell capability means any secret reachable at the keyboard could have been captured.