Research reports

GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File

We’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now has a second stage that persists even if the victim has removed the malicious workflow. Existing Stage 1: Use stolen GitHub…

Infostealers

WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials

The OpenSourceMalware team spends a lot of time looking at malicious npm packages, and after a while you start seeing the same patterns over and over. So when something new and genuinely different shows up, it’ stopping for. That happened this week when we…

Supply chain

ChainVeil and ViteVenom are DPRK’s PolinRider Campaign

On June 16, 2026, Checkmarx Zero published a detailed breakdown of an npm supply chain campaign they named "ChainVeil." It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT), a four-tier blockchain command channel…

MalwareSupply chain

PolinRider Confirmed Footprint Grows 6.5x Since March

In the three months since we discovered the PolinRider campaign, we've observed it growing to become a major source of malicious activity. We recently completed a fresh hunt that surfaced an entire new wave of victims: Our July hunt uncovered 2,417…

Lazarus Group Uses Git Hooks To Hide Malware

The OpenSourceMalware team has spotted a fresh twist in the DPRK's Contagious Interview / TaskJacker playbook: the operators have pivoted away from stuffing their stage-2 loader into .vscode/tasks.json , package.json postinstall scripts, or fake .woff2 font…

State-sponsoredMalware