OmniStealer
OmniStealer is an information-stealing malware family linked in the provided reporting to DPRK/North Korea activity, including Famous Chollima and broader Void Dokkaebi/Contagious Interview-style operations. The content associates OmniStealer with campaigns targeting developers through social-engineering lures such as fake job offers and developer tasks, including weaponized Node.js projects hosted on GitHub and software supply-chain compromises affecting developer workflows.
In the cited reporting, OmniStealer is not described as the visible first-stage loader itself, but as a payload delivered by multistage JavaScript/Node.js loaders. Those loaders were observed hidden in development artifacts such as appended obfuscated JavaScript in tailwind.js within the Packagist dev release dev-drewroberts/feature/test-case of the legitimate roberts/leads package, and in broader compromised repositories that also used malicious .vscode/tasks.json files. The loaders retrieved encrypted payload material from public blockchain infrastructure including TRON, Aptos, and BNB Smart Chain, decrypted it with embedded XOR keys, and executed it via eval(); they could also spawn detached hidden Node.js child processes with windowsHide set to true. Reporting states this blockchain dead-drop infrastructure and campaign marker global['!']='9-0264-2' overlap with prior DPRK-linked malware delivery involving DEV#POPPER RAT, OmniStealer, and BeaverTail-family payloads.
The content explicitly identifies OmniStealer as an information stealer. While the local loader in the Packagist case did not directly exfiltrate files or credentials, the delivered payloads were described as capable of accessing process.env, local files, Git metadata, network APIs, and child-process execution; additional reporting notes remote payload access to environment variables containing cloud credentials and CI secrets, local files such as .env files and SSH keys, stored tokens, and the ability to execute additional processes. OmniStealer is repeatedly grouped with other DPRK-linked malware families including DEV#POPPER, BeaverTail, InvisibleFerret, and OtterCookie.
High-confidence indicators and contextual artifacts from the associated delivery infrastructure in the content include the campaign marker global['!']='9-0264-2' / global['_V']='A9-0264-2'; TRON wallet addresses TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG; Aptos identifiers 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3; XOR keys 2[gWfGj;<:-93Z^C and m6:tTh^D)cBz?NM]; malicious branch commit 6c5c3c7655ce76399af11126b7e9a9058eb2e45d; archive SHA-256 522b28a2f78771715497ba53729d4ab9a50e982322c391379f3bddf7c8cb363f; and tailwind.js SHA-256 96afdba882046385242cbed46871e41147c8055c5d9eff7460847b2c01a77dc3. The content does not provide a standalone technical breakdown of OmniStealer internals beyond its role as a DPRK-linked information stealer delivered in these campaigns.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In prior reports using the same blockchain-C2 infrastructure and overlapping wallet addresses, the loader ultimately delivered DPRK-linked malware including DEV#POPPER RAT, OmniStealer, and BeaverTail-family payloads.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
3 techniques
Initial Access
Contagious Interview ... tricks them into executing malicious code from a fake repository as part of an assessment.
A well-known North Korean threat actor has been caught hiding malware inside a legitimate PHP package available through Packagist... The package itself belongs to a legitimate maintainer named Drew Roberts, suggesting either a branch-level compromise or a poisoned workflow injection rather than a wholly fabricated fake package.
Execution
5 techniques
Execution
It can also quietly launch a second hidden process in the background using child_process.spawn() with the windowsHide flag set to true, keeping everything out of sight on Windows systems.
MITRE ATT&CK # T1059.007 — Command and Scripting Interpreter: JavaScript
The malware sits quietly inside what looks like a standard Tailwind CSS configuration file... Once that obfuscated code runs, it quietly transforms into a full JavaScript malware loader operating inside Node.js.
Stealth
3 techniques
Stealth
The appended JavaScript is obfuscated and reconstructs its real behavior at runtime... A large whitespace gap hides the malicious payload after the legitimate Tailwind configuration, making it easy to miss in code review.
Credential Access
1 technique
Credential Access
Collection
1 technique
Collection
IOCs tracked for this family
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information-stealing malware associated with Famous Chollima and linked to this campaign through a known operation marker.
A DPRK-linked stealer payload associated with the same blockchain dead-drop loader chain referenced in the report.
Named malware/tool referenced in connection with Contagious Interview via hashtags; no further behavior is described in the provided content.
Named as part of the threat actor's malware toolset that can be delivered through the blockchain-based staging mechanism.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.