ChainVeil

TRON, Aptos and BSC in One Infection Chain: JavaScript Loader Linked to ChainVeil Campaign

Researchers at Checkmarx examined the ChainVeil campaign that used npm packages to distribute multi-stage JavaScript loaders. A newly discovered sample appeared in a GitHub repository recommended by an AI agent, where the file navigation.js contained an obfuscated loader that matched the campaign's techniques. The loader retrieves encrypted payloads from TRON, falls back to Aptos, and then uses the extracted data as a BSC transaction identifier to fetch the next stage. C2 infrastructure and final RAT functionality aligned exactly with previously published indicators, except for the campaign identifier A9-0554-3 instead of the A6-* markers seen in npm samples. Git history showed the malicious code was inserted via a merge commit on 29 March 2026, months before the first known npm packages appeared in May. The findings indicate that npm was never the only distribution channel for ChainVeil and that the campaign's blockchain-based delivery mechanism has been active since at least early 2025.