MUT-8694: An NPM and PyPI Malicious Campaign Targeting Windows Users | Datadog Security Labs

MUT-8694 is a persistent threat actor conducting a supply chain attack across both npm and PyPI ecosystems, distributing malicious packages that deliver infostealer malware to Windows users. The campaign uses typosquatting and obfuscated code to distribute Blank Grabber and Skuld Stealer, both open-source infostealers targeting credentials, cryptocurrency wallets, and gaming data. The threat actor leverages legitimate services like GitHub and Replit to host payloads and employs PowerShell-based execution and evasion techniques, including disabling Windows Defender and exfiltrating data via Telegram and Discord.

AI-extracted · verify before operational use