The loader’s evolution from basic prototypes to sophisticated malware demonstrates deliberate advancement in obfuscation techniques, progressing from simple remote code execution capabilities to comprehensive system profiling and multi-endpoint command rotation, positioning it as a formidable threat to software supply chain security. The newly discovered XORIndex malware, named for its distinctive use of XOR-encoded strings and index-based obfuscation techniques, demonstrates the threat actors’ continued evolution in developing sophisticated evasion mechanisms. North Korean threat actors have escalated their software supply chain attacks with the deployment of 67 malicious npm packages that collectively garnered over 17,000 downloads before detection. This latest campaign represents a significant expansion of the ongoing “Contagious Interview” operation, introducing a previously unreported malware loader dubbed XORIndex alongside the existing HexEval Loader infrastructure. The XORIndex Loader operates as a multi-stage attack framework, initially collecting host metadata before decoding and executing the BeaverTail second-stage malware, which subsequently references the InvisibleFerret backdoor for persistent access. The malware employs a sophisticated reconnaissance phase, gathering comprehensive system information including hostname, username, external IP address, geolocation data, and platform details before establishing communication with command and control servers. The XORIndex Loader has accumulated over 9,000 downloads between June and July 2025, operating in parallel with the continuing HexEval campaign that has generated an additional 8,000 downloads across newly discovered packages. Socket.dev analysts identified this campaign as part of a broader North Korean cyber espionage effort targeting developers, cryptocurrency holders, and individuals with access to sensitive credentials. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Jul 2025 04:30:09 +0000