🕵️ OmniStealer

The items that name it 5

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeupas threat actors2026-09-20

  Python-based infostealer; Socket assesses with medium likelihood that the captured 82,457-byte Python infostealer is an iteration of OmniStealer.

• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeupas threat actors2026-07-31

  Python infostealer component (reversed-base64, zlib-wrapped) harvesting browser credentials, crypto wallets, password managers, developer tool configs, and OS keystores; exfiltrates via HTTP C2 and a Telegram bot.

• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas classification.key entities2026-07-08
• Socket: PolinRider
  writeupas threat actors2026-07-02

  Malware payload observed being delivered by PolinRider loaders, providing command execution, socket.io-client-based C2 communication, credential theft, browser-data theft, and wallet exfiltration

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeupas threat actors2026-06-01

  DPRK-linked malware delivered in prior reports using overlapping wallet addresses and same loader architecture