TRON, Aptos and BSC in One Infection Chain: JavaScript Loader Linked to ChainVeil Campaign
Researchers from Checkmarx have published an in-depth analysis of the ChainVeil campaign, which abused npm packages to deliver multi-stage JavaScript loaders. A previously unknown sample of the same family recently surfaced in a GitHub repository that an AI coding assistant recommended to a developer.
The malicious code was discovered inside the file navigation.js of the inbox-ai project. Initial inspection revealed an obfuscated one-liner appended after a large block of whitespace. The loader begins by declaring the global identifier A9-0554-3, differing from the A6-* markers documented by Checkmarx for the npm samples.
The sample employs the same three-blockchain delivery chain described in the Checkmarx report: it first queries the latest outgoing TRON transaction, falls back to Aptos if necessary, and then uses the decoded value as the transaction hash on BSC to retrieve the next-stage payload. Extracted strings and C2 addresses matched the infrastructure previously attributed to the campaign.
Git history shows the clean version of navigation.js was added in November 2025. The malicious block appeared during a merge commit on 29 March 2026. The same technique was later used to infect calendar-rail.js. The code remained in the repository for more than five months.
Blockchain analysis revealed that the campaign's payload-update cadence averaged two to three days, with occasional bursts of rapid updates. A BSC transaction from February 2025 already contained data consistent with the observed loader chain, pushing the suspected start of activity earlier than previously reported.
The final stage delivered by the loader is a remote-access trojan whose capabilities match those detailed by Checkmarx. Researchers note that the repository compromise predates the first publicly documented npm packages by nearly two months, suggesting that ChainVeil operators have used multiple distribution vectors beyond the npm ecosystem.
Related articles
Malinsure Cybercrime Group Deploys SafeMostSSH Backdoor via Phishing Lures Mimicking Russian Insurance Updates
Researchers from F6 identified a previously unknown cybercrime cluster named Malinsure that has been active since at least July 2026. The group distributes phishing emails containing PDF lures themed around voluntary medical insurance (DMS) discounts and updates from Russian insurance companies. Victims are tricked into downloading RAR or ZIP archives that abuse legitimate Microsoft binaries such as winword.exe and powerpnt.exe through DLL side-loading to execute the custom SafeMostSSH backdoor. The malware establishes a persistent reverse SSH tunnel to attacker-controlled servers and retrieves fresh C2 addresses from public posts on vc.ru by decoding fake PNG links. Additional delivery vectors include HTML and SHTML files that decode and drop archives containing the same payload components. Targets appear to include insurance, finance, and fuel-energy sector organizations, with infrastructure also referencing gosuslugi.email and minfin.support domains.
Compromised Chromium Extensions Push Malware Through Fake Critical Update Alerts
Users of Chromium-based browsers including Chrome, Brave, and Opera have encountered persistent pop-up windows demanding immediate browser updates. These alerts originate from compromised extensions that dynamically load malicious VBS scripts or EXE files instead of delivering legitimate updates. The deceptive messages appear during normal browsing and instruct users to download and manually execute suspicious files. Earlier incidents were traced to the QuickLens extension, while current reports implicate Enable Right Click & Copy Smart Unlock + OCR and similar utilities still available in the Chrome Web Store. Attackers achieve persistence by purchasing popular extensions or hijacking developer accounts to push malicious updates. Full system scans often fail to detect the threat because the browser itself remains clean until the user triggers the payload. Security experts recommend verifying updates exclusively through the browser's built-in menu rather than clicking any on-screen prompts.
Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB
Researchers at Palo Alto Networks Unit 42 have identified Kimwolf v7, an updated botnet that compromises Android set-top boxes and other IoT devices to conduct DDoS attacks. The malware now employs HTTP/2 flooding with realistic browser fingerprints to blend malicious traffic with legitimate user activity. Command-and-control infrastructure is hardened through Ethereum Name Service lookups and public Ethereum RPC services, with a Tor fallback address embedded in the binary. Operators have removed scanning, exploitation, and brute-force capabilities from this version, indicating a division of labor where a separate loader handles initial infection. The botnet uses 15 numbered methods focused on high-performance UDP floods optimized for ARM processors. Infections typically occur through residential proxies targeting devices with open Android Debug Bridge on port 5555, after which the malware masquerades as system processes. Unit 42 advises treating Android set-top boxes as untrusted devices and disabling ADB or restricting it to USB access only.
Google Play Apps Hide Anatsa Banking Trojan Using Stealthy Loaders
Malicious applications distributed through Google Play are employing stealthy loaders to install the Anatsa banking trojan for Android, putting victims' financial accounts at risk. The campaign relies on seemingly legitimate programs to conceal the initial infection stage, with one identified case involving a modified PDF reader that displays a fake update prompt to trick users into installing an additional component. Another loader discovered in the Cleanova application collects data from analytics SDKs, including installation source details, and forwards this information to a command-and-control server. The server then decides whether to deliver the malicious payload based on predefined criteria, leaving the code inactive for non-targeted victims to evade automated analysis. Once Anatsa is installed, the threat can facilitate theft of credentials used for financial services and enable fraudulent transactions. Banking trojans represented 30.77 percent of detected malicious mobile applications in the second quarter of 2026, during which more than 1.99 million attacks involving malware, adware, or unwanted programs were blocked and 93,574 banking trojan installation packages were identified.