🕵️ Overlord RAT

The items that name it 4

• The OpenSourceMalware Show #27
  talk2026-10-29It is written here as Overlord RAT (Go-based, delivered by MALFEX npm packages).

  Go-based, delivered by MALFEX npm packages

• Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads
  article2026-10-08

  Go-based remote access trojan delivered via tlxbnhd, tldriver, mxdriver packages; provides screen capture, keylogging, clipboard monitoring, file search, remote shell, and a hidden virtual desktop. Uses a Solana blockchain-based C2 resolver to dynamically locate command-and-control infrastructure. A

• MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work
  writeup2026-10-05
• MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
  article2026-09-30

  Open-source Go-based remote access trojan; can capture screens, record keystrokes, provide remote shell access and interact with victim's desktop; this version uses the Solana blockchain to retrieve updated C2 server addresses