# Remote Access Trojan Published articles for Remote Access Trojan. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure DevFeed: [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure]() Original publisher: [Read original article]() Author: Rem Dudas Published: 2026-09-09T10:00:55Z Content type: article Language: en Sources: [Unit 42]() Topics: [ARKTunnel](), [backdoor]() Tags: [arktunnel](), [backdoor](), [c2](), [cl-cri-1171](), [cybercrime](), [docro-hijacker](), [gaming](), [malware](), [pay-per-install](), [payload](), [remote-access-trojan](), [threat-research](), [youtube]() ### AI overview An investigation of the CL-CRI-1171 cybercrime campaign describes how YouTube gaming lures and SEO poisoning delivered malware through a custom loader. It covers Docro Hijacker, ARKTunnel, and the Insomnia remote access Trojan. ### Source excerpt An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks. The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42. ## Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams DevFeed: [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams]() Original publisher: [Read original article]() Author: Noam Sala Published: 2026-08-31T10:00:36Z Content type: article Language: en Sources: [Unit 42]() Topics: [Social engineering](), [Malware](), [remote access software](), [Microsoft](), [Cloaked Ursa](), [Entra ID](), [Incident response]() Tags: [attacks](), [cloaked-ursa](), [enterprise](), [entra-id](), [incident-response](), [malware](), [microsoft](), [microsoft-teams](), [payload](), [phishing](), [powershell](), [remote-access-trojan](), [social-engineering](), [spoof](), [threat-research](), [vishing](), [voice]() ### AI overview Spring Ring is a coordinated social engineering campaign that used external Microsoft Teams accounts and voice phishing to impersonate IT help desk staff. The operation targeted more than 150 employees across at least 10 companies and attempted to deliver remote monitoring and management tools or custom malware. A more advanced variant escalated to an NTLM relay attack against an organization's domain controller. ### Source excerpt Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams appeared first on Unit 42. ## AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026) DevFeed: [AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)]() Original publisher: [Read original article]() Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub Actions](), [npm packages](), [AsyncAPI Specification](), [Malware](), [GitHub](), [Remote Access Trojan](), [passwords](), [ssh](), [Cloud](), [Cryptocurrency]() Tags: [asyncapi-supply-chain-attack](), [chainguard-asyncapi](), [chainguard-libraries](), [ci](), [cloud](), [cryptocurrency](), [github](), [github-actions](), [github-actions-pwn-request](), [malicious-packages](), [malware](), [miasma](), [npm](), [npm-packages](), [passwords](), [personal-access-token](), [provenance](), [pull-requests](), [remote-access-trojan](), [ssh](), [supply-chain](), [tokens]() ### AI overview The article analyzes a July 14, 2026 supply-chain compromise in which an attacker stole a privileged GitHub personal access token through a misconfigured GitHub Actions workflow and used it to publish five backdoored versions across four AsyncAPI npm packages. The malware activates when a library is loaded by a build or CI job and steals browser passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets while maintaining command-and-control access. It also explains why Chainguard customers were protected and recommends treating affected environments as compromised and rotating credentials. ### Source excerpt A supply chain attack compromised AsyncAPI npm packages via GitHub Actions. See how Chainguard blocked the malicious releases by design. ## The full Snyk AI Security Platform, free for open source maintainers DevFeed: [The full Snyk AI Security Platform, free for open source maintainers]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-06-18T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Maintainers](), [Open Source](), [Security](), [vulnerability](), [open-source-security](), [Artificial Intelligence](), [Frontier Model](), [Remote Access Trojan](), [AI Infrastructure]() Tags: [agent](), [ai](), [ai-infrastructure](), [ai-security](), [article](), [awareness](), [bugs](), [developer](), [enablement](), [engineering](), [frontier-model](), [interest](), [maintainers](), [open-source](), [open-source-security](), [remote-access-trojan](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-team](), [software](), [supply-chain-security](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk's Secure Developer Program gives qualifying open source projects free access to the Snyk AI Security Platform. It is designed to help maintainers prioritize real vulnerability reports and produce validated, merge-ready fixes through the Snyk Remediation Agent. ### Source excerpt Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Snyk's Secure Developer Program gives qualifying projects free access to the Snyk AI Security Platform. ## @mastra npm scope takeover: 143 packages backdoored via compromised contributor account DevFeed: [@mastra npm scope takeover: 143 packages backdoored via compromised contributor account]() Original publisher: [Read original article]() Published: 2026-06-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Malware](), [Remote Access Trojan](), [Cryptocurrency](), [C2]() Tags: [c2](), [chainguard-libraries](), [chainguard-packages](), [command-and-control](), [crypto](), [malware](), [mastra](), [npm](), [npm-takeover](), [packages](), [provenance](), [remote-access](), [remote-access-trojan](), [secure-packages](), [software-packages](), [supply-chain](), [tls]() ### AI overview The article reports that an attacker used a compromised former contributor account to republish all 143 packages in the @mastra npm scope on June 17, 2026. The malicious versions could disable TLS verification, download a cryptocurrency wallet stealer and remote access trojan, and establish command-and-control access. It recommends auditing dependency trees and lockfiles and rotating credentials on affected hosts. ### Source excerpt A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries. ## A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope DevFeed: [A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope]() Original publisher: [Read original article]() Author: Liran Tal; Marian Corneci Published: 2026-06-16T21:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [awareness](), [blog](), [ci-cd](), [cross-platform](), [cryptocurrency](), [developer](), [devops](), [devrel](), [devsecops](), [incident](), [javascript](), [node-js](), [open-source-security](), [payload](), [persistence](), [remote-access-trojan](), [sbom](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [tls](), [vulnerability-insights]() ### AI overview A dormant former-contributor npm account was compromised and used to republish the Mastra package scope with a malicious dependency that installs cryptocurrency-stealing malware and a persistent remote-access trojan. The article describes the stale access control that enabled the supply-chain incident and advises treating affected installations as credential and wallet exposure events. ### Source excerpt A dormant contributor account was used to republish the entire @mastra npm scope, each injected with a single dependency, easy-day-js, that drops a cross-platform cryptocurrency stealer. Here is how the attack worked, how to check exposure, and how to remediate. ## BTMOB: A stealthy RAT burrowing deep into Android devices DevFeed: [BTMOB: A stealthy RAT burrowing deep into Android devices]() Original publisher: [Read original article]() Author: Daniel Cunha Barbosa Published: 2026-05-26T08:50:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ransomware](), [Remote Access Trojan](), [Android](), [Social engineering](), [APK](), [Tooling](), [Accessibility]() Tags: [android](), [code](), [malware](), [phishing](), [remote-access-trojan](), [social-engineering](), [tool]() ### AI overview BTMOB is an Android remote access trojan that spreads through phishing websites, fake app stores, and malicious APKs. It can exfiltrate sensitive data, capture screenshots, record device activity, and enable remote control. Its APK builder and malware-as-a-service model make customized campaigns easier to launch. ### Source excerpt The malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise ## Malicious axios versions published to npm: Chainguard customers protected DevFeed: [Malicious axios versions published to npm: Chainguard customers protected]() Original publisher: [Read original article]() Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [axios](), [npm](), [Remote Access Trojan](), [Open Source](), [JavaScript](), [payload](), [Single-page application (SPA)](), [Filesystems](), [HTTP](), [Script](), [Linux](), [macOS]() Tags: [axios](), [axios-attack](), [axios-npm-attack](), [axios-supply-chain-attack](), [c2](), [chainguard-actions](), [chainguard-axios](), [chainguard-libraries](), [chainguard-npm-libraries](), [dependency](), [files](), [http](), [javascript](), [linux](), [macos](), [npm](), [npm-packages](), [payload](), [remote-access-trojan](), [script](), [supply-chain-attacks](), [windows]() ### AI overview The article reports that two malicious axios versions were published to npm with a hidden dependency that deployed a cross-platform remote access trojan on macOS, Windows, and Linux. It explains the compromised maintainer account, post-install execution, command-and-control communication, payload delivery, and recommended auditing and remediation steps. Chainguard customers were protected by package-blocking and source-verification controls. ### Source excerpt Malicious axios versions on npm delivered a RAT via a hidden dependency. Chainguard customers were protected by blocking unsafe packages and verifying source. ## Compromised axios npm package delivers cross-platform RAT DevFeed: [Compromised axios npm package delivers cross-platform RAT]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm packages](), [Remote Access Trojan](), [backdoor](), [account takeover](), [payload](), [npm](), [OpenID connect (OIDC)](), [GitHub Actions](), [Linux](), [Windows]() Tags: [account-takeover](), [backdoor](), [ci-cd](), [github-actions](), [linux](), [npm-packages](), [oidc](), [payload](), [remote-access-trojan](), [supply-chain](), [windows]() ### AI overview The article analyzes a March 31, 2026 supply-chain compromise in which an attacker hijacked an axios npm maintainer account and published two malicious releases. The releases added a typosquatted dependency that installed a cross-platform remote access trojan, though bugs limited the Windows and Linux payloads. The compromise lasted about three hours before npm removed the packages. ### Source excerpt An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. ## Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT DevFeed: [Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-03-30T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [StreamRAT](), [cross-platform](), [JavaScript](), [CI/CD](), [ide](), [client](), [GitHub]() Tags: [analysis](), [awareness](), [blog](), [c2](), [ci](), [ci-cd](), [code](), [developer](), [devrel](), [github](), [javascript](), [macos](), [malware](), [obfuscation](), [payload](), [remote-access-trojan](), [security](), [server](), [snyk-open-source](), [snyk-platform](), [supply-chain](), [supply-chain-security]() ### AI overview The article analyzes a supply-chain attack in which malicious Axios versions published to npm through a compromised maintainer account introduced a hidden dependency. Installing the affected packages could trigger a postinstall dropper that downloaded a platform-specific remote access trojan, contacted a command-and-control server, and erased evidence after execution. ### Source excerpt Meta description: Malicious versions of the Axios npm package (1.14.1 and 0.30.4) were published via a compromised maintainer account, injecting a hidden dependency that deploys a cross-platform remote access trojan. Here's what happened, who's affected, and how to check your exposure.