MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data

CloudSEK identified the MALFEX campaign in which malicious npm packages and related GitHub payloads were used to deploy the Go-based Overlord RAT on Windows systems and to exfiltrate Discord tokens, browser cookies and credentials, cryptocurrency wallet data, and Telegram sessions; multiple connected packages and dependencies remained live for months, and the operation appears tied to a single Portuguese-speaking operator.