Elastic and Microsoft Tear Apart the Axios RAT: One Cross-Platform Implant, Three OS Targets

Analysis

Elastic Security Labs: The Axios RAT Is One Unified Implant with Three Platform-Native Implementations

Elastic's teardown confirms the Windows (PowerShell), macOS (C++), and Linux (Python) payloads are not separate tools but a single RAT framework with identical C2 protocol, command set, and beacon cadence. The hardcoded IE8/Windows XP user-agent string across all three variants is the single most reliable detection signal your network monitoring should be hunting for right now.

Emergence AI CISO Breaks Down the Exact Controls That Would Have Blocked the Axios Attack

This post is the most actionable post-mortem for engineering teams: exact version pinning enforced in CI, frozen lockfiles, postinstall scripts disabled, OIDC provenance required, and a 72-hour package release cooldown policy. The stolen long-lived npm access token that bypassed 2FA is the root cause most teams still haven't addressed.

Orca Security: Full Technical Remediation Guide Including Package Hashes, Host Indicators, and Detection Commands

Orca's write-up adds concrete detection commands, SHA-256 hashes for all payloads, and a clear breakdown of the phantom dependency trick and anti-forensic manifest swap. The table covering additional distribution vectors (@shadanai/openclaw and @qqbrowser/openclaw-qbot) is important context most teams have missed.

Threat Intelligence

Microsoft Threat Intelligence Attributes Axios npm Compromise to Sapphire Sleet (North Korean State Actor)

Microsoft formally ties the axios attack infrastructure and the plain-crypto-js account to Sapphire Sleet, the DPRK group that previously targeted crypto and finance orgs via LinkedIn lures and fake meeting links. If you have axios@1.14.1 or 0.30.4 anywhere in your CI/CD history, rotate secrets now and audit for the registry run key at HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate.

TeamPCP Hit Five Open Source Projects in 13 Days Before Axios: The Full Campaign Timeline

Hive Security lays out the broader TeamPCP campaign that targeted Trivy, KICS, LiteLLM, and Telnyx in the two weeks before Axios, all developer tools and infrastructure libraries chosen specifically because CI/CD pipelines run with high-privilege credentials. The Initial Access Broker model explains why there was no ransomware or cryptominer in the payload -- the access itself is the product being sold.