Axios npm RAT: Malwarebytes IOC Roundup, Qualys Detection QIDs, and the North Korean Attribution Chain

Analysis

Malwarebytes Publishes IOC List and Blocks Axios RAT Infrastructure

Malwarebytes confirms it is blocking the C2 domain sfrclak[.]com and IP 142.11.206.73, and provides a clean rundown of per-platform artifacts to hunt for. Worth bookmarking: the dropper self-destructs, so the file-based IOCs are your best post-infection signal on Windows and Linux.

Datadog: Windows and Linux RAT Payloads Contain Bugs That Limit Impact

Datadog's deep dive finds both the Windows and Linux second-stage payloads have implementation bugs that partially break the RAT, with the Linux variant crashing outright in containerized environments. The bugs reduce but do not eliminate risk, and CI/CD systems on macOS or bare-metal Linux should still treat any install of the affected versions as a full compromise.

Tools

Qualys Assigns QIDs 386943 and 5010006 for Axios RAT Detection

Qualys has mapped the Axios compromise to two specific detection IDs, with QID 5010006 requiring SwCA to be enabled. If you are running Qualys in your pipeline, this is the fastest path to confirming whether affected versions touched your fleet.

News

Microsoft Attributes Axios npm Compromise to North Korea's Sapphire Sleet

Microsoft Threat Intelligence ties the C2 infrastructure and the compromised plain-crypto-js package to Sapphire Sleet, a North Korean actor focused on cryptocurrency theft. The attribution matters because it signals this was a targeted, resourced operation, not an opportunistic script kiddie run.

Sonatype Tracks OpenClaw Package Spread Beyond the Core Axios Compromise

Sonatype found the same malicious plain-crypto-js dependency propagating into a cluster of OpenClaw-associated packages, expanding the blast radius well beyond the two headline Axios versions. This confirms the attacker was running a broader distribution play, not just a single package hit.