Ankura CTIX FLASH Update – March 27, 2026

Malware Activity

Ghost Campaign Abuses npm Install Process to Deliver Stealthy Crypto-Stealing Malware

A newly identified supply chain attack campaign, dubbed the "Ghost campaign" by ReversingLabs, leverages malicious npm packages that mimic legitimate installation activity to covertly deploy malware targeting sensitive data and cryptocurrency wallets. First observed in early February 2026, the campaign uses deceptive techniques such as fake npm installation logs, including simulated dependency downloads, progress indicators, and delays, to create the illusion of a normal install process. During this staged execution, victims are prompted to enter their sudo password under the cover of resolving installation issues or performing optimizations, and the credentials are then used to execute a remote access trojan (RAT). The final payload is retrieved from external infrastructure, including Telegram channels and hidden web3-hosted content, decrypted using a remotely fetched key, and