OX Security

PhantomSub Campaign Deploys 101 Malicious npm Packages to Hijack WhatsApp Accounts for Unauthorized Channel Subscriptions

Researchers at OX Security uncovered 101 malicious npm packages tied to the PhantomSub campaign that abuse connected WhatsApp accounts to subscribe users to promotional channels without consent. The packages disguise themselves as modified versions of the open-source Baileys library used for WhatsApp automation. Attackers rely on authenticated sessions rather than simple package installation, allowing them to control subscriptions through lists stored on GitHub, in plaintext, or as encoded identifiers. The packages have accumulated roughly 490,000 downloads, including 116,000 in the past 30 days, though the exact number of compromised accounts remains unknown. As of 28 September, npm had removed only 16 of the identified packages. The operation ultimately benefits channels selling bots, game resources, accounts, and promotion services by inflating subscriber counts while disabling notifications to hide the activity.

No Hacker Genius Needed: One Login and 49 Minutes Suffice in Injective Supply Chain Attack

A routine update to the @injectivelabs/sdk-ts library for Injective blockchain wallets turned into a supply-chain trap within 49 minutes, stealing users' recovery phrases and private keys. The malicious version 1.20.21 was published on npm on July 8, 2026, after attackers compromised a long-trusted maintainer account and pushed code directly to the main branch. The backdoor, disguised as anonymous performance statistics collection, activated only when applications called PrivateKey.fromMnemonic() or PrivateKey.fromHex(), exfiltrating sensitive data via the X-Request-Id header to an attacker-controlled server mimicking Injective infrastructure. Eighteen Injective Labs packages were affected, with 87 downstream dependencies also pulling in the compromised library, which sees roughly 175,000 monthly downloads. Although developers rolled back the changes and released clean version 1.20.23 within 49 minutes, at least 310 malicious downloads were recorded, and cached copies may persist in build environments. Security researchers from Datadog, Socket, StepSecurity, and OX Security have advised immediate migration to the patched release and full key rotation for any wallets that interacted with the tainted code.