IN mid-2026, researchers from Zscaler ThreatLabz reported a trojanised Terraform provider masquerading as an AWS plugin. The malicious provider, named terraform-provider-awsbeta, is designed to load when Terraform starts, then silently install malware on macOS, Linux, or Windows machines.
The delivery chain includes a hidden payload baked into the provider, which, after execution, downloads a Bash script from lookalike domains such as hashicorp-terraform[.]io and runs in the background while the provider continues to respond as a legitimate plugin. The loader then fetches a further payload disguised as a font file from multiple public hosts, dynamically decrypting and executing it using available scripting tools. On macOS, it also clears the quarantine flag and signs the resulting file before execution.
The operation culminates in two main backdoors: FLATROOF, a Rust-based backdoor that persists and communicates with operators via Telegram, GitHub, or a webhook, and performs data theft including browser passwords, cookies, shell history, and system details; on Windows, it also targets crypto wallet extensions. FLATROOF drops ROOFDECK, a second backdoor for Windows and macOS, which provides broader control (shell, reverse shell, file transfer, clipboard access) and supports updating or wiping the agent.
Threat researchers tie the activity to the suspected TraderTraitor group (a North Korea–linked actor), noting overlaps with other TraderTraitor activity but emphasising that attribution remains not highly confident. The report stresses the risk to cloud engineers and developers using Terraform, and calls for strict provenance checks on third-party plugins and heightened monitoring of build and CI/CD environments. UK authorities have not disclosed any confirmed victims or law enforcement actions to date.