Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
The MALFEX npm campaign ships Overlord RAT and movinlike to steal browser passwords, Discord tokens, and crypto wallets.
71
Product
Coinbase Wallet
- Mentions · 7d0
- Mentions · 30d1
- All mentions2
- First seenSep 17, 2026
- Last mentioned24d ago
Timeline
2 articles · newest firstFake AI trading agent steals crypto wallet passwords
Fake AI crypto trading agent sites deliver Needle Stealer, which replaces browser wallet extensions to steal wallet passwords, HP reports.
65
Appears with
- Phantomproduct · 2
- MetaMaskproduct · 2
- movinlikemalware · 1
- Phantom Stealermalware · 1
- MALFEXthreat actor · 1
- Microsoftvendor · 1
- HPvendor · 1
- Telegram Desktopproduct · 1
- PureLogs Stealermalware · 1
- Needle Stealermalware · 1
- Checkmarxorganization · 1
- Overlord RATmalware · 1
- Discordproduct · 1
- npmproduct · 1
- GitHuborganization · 1
- XWormmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.