Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A recent investigation has unveiled a sophisticated malware campaign that targets Windows systems via a cleverly disguised package on the npm registry. This malicious package masquerades as a legitimate CSS build tool, but in reality, it stealthily installs a fully functional Remote Access Trojan (RAT) on developer machines.

The infection process begins with a typosquatted npm package named postcss-minify-selector-parser, which is designed to mimic the well-established postcss-selector-parser, a package that boasts over 150 million weekly downloads. When developers unwittingly install this counterfeit package, a hidden encoded blob within the entry file triggers a multi-stage attack chain.

As the attack unfolds, the payload ultimately deploys a Windows RAT capable of stealing credentials, executing shell commands, and establishing communication with a remote attacker. Security researchers at JFrog identified this threat and shared their findings in a detailed report published on June 22, 2026, with Cyber Security News (CSN). Their investigation also revealed two additional related packages, postcss-minify-selector and aes-decode-runner-pro, all linked to the same npm publisher. At the time of the report, these packages remained live and accessible on the registry.

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence

The sophistication of this campaign lies in its ability to blend seamlessly into the development environment. The fake package employs identical keywords and even depends on the genuine postcss-selector-parser, making it easy to overlook during routine dependency audits. Developers engaged in fast-paced projects, particularly those who do not audit transitive dependencies, are at heightened risk, as the attackers have clearly understood the dynamics of trust within open-source ecosystems.

The true extent of the damage becomes apparent only after the complete payload chain executes. A PowerShell downloader retrieves a ZIP archive from a lookalike domain, extracts its contents, and initiates a VBS script to activate the RAT. This final implant operates as a bundled Python application compiled with Nuitka, complicating inspection efforts compared to typical script-based threats.

Once the RAT is active on a victim’s machine, it establishes a connection with a command-and-control (C2) server over HTTP. All communications are encrypted using RC4/ARC4 wrapping with MD5 checksum material, rendering it difficult to detect at the network level. The RAT sends an initial host profile to the C2 and enters a loop, awaiting commands from the attacker.

To ensure persistence across reboots, the malware creates a registry key under the Windows Run key, using the entry name csshost. It also stores a persistent victim UUID and host configuration in files placed in the TEMP directory, allowing the RAT to reconnect automatically the next time the machine starts, even if the attacker loses contact.

This RAT boasts a wide array of capabilities, including remote shell execution, file upload and download, randomized sleep commands, and virtual machine detection. The evasion techniques employed, such as WMI queries and MAC address prefix matching, indicate a threat actor with considerable technical acumen and operational experience.

Chrome Credential Theft and Exfiltration

In addition to remote control functionalities, the RAT features a dedicated module for stealing saved login data from Google Chrome. It accesses Chrome’s local profile files, including the Login Data SQLite database, and utilizes Windows decryption APIs to unlock stored passwords. Notably, it can also handle newer Chrome app-bound encryption, posing a threat even to recently protected credentials.

The auto.pyd module collects data from Chrome extensions, packaging the results into an in-memory archive before exfiltration. Output file references found within the binary, such as chromeloginsdump.txt and gather.tar.gz, suggest that the attacker designed this malware for organized batch exfiltration. This presents a significant and immediate risk for developers who store API keys, tokens, or credentials in their browsers.

JFrog advises anyone who has installed packages from this cluster to remove them immediately and to inspect their full dependency trees for potential risks. Security teams are urged to block network indicators associated with this campaign and to search endpoints for related file paths and executables. All browser-stored credentials and development tokens on affected machines should be treated as compromised and rotated without delay.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.