Poisoned Pipeline / Incidents / AS184

AS184 · 2025-09

Telegram, Discord, and WhatsApp-developer malware packages

npmPyPIRubyGemsBrowser extensionsCDN / web assets

Socket posts on messaging-app developer targeting: Telegram bot malware,
Ruby gems stealing Telegram tokens, PyPI Discord token theft, Blank Grabber,
Discord-CDN typosquats, WhatsApp remote-trigger packages, Discord as C2.

Mapped techniques

• T0109 Publish malicious artifact
• T0136 Brandjacking
• T0172 Runtime backdoor
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/npm-malware-targets-telegram-bot-developers
• https://socket.dev/blog/malicious-ruby-gems-exfiltrate-telegram-tokens-and-messages-following-vietnam-ban
• https://socket.dev/blog/malicious-pypi-package-targets-discord-developers-with-token-theft-and-backdoor
• https://socket.dev/blog/blank-grabber-python-package-steals-info-from-discord-and-telegram
• https://socket.dev/blog/two-typosquatting-python-packages-exploit-discord-cdn-to-deploy-malicious-payloads
• https://socket.dev/blog/trends-in-malicious-packages-targeting-discord
• https://socket.dev/blog/malicious-npm-packages-target-whatsapp-developers-with-remote-kill-switch
• https://socket.dev/blog/malicious-npm-package-exploits-whatsapp-authentication-with-remote-kill-switch
• https://socket.dev/blog/weaponizing-discord-for-command-and-control