Researchers Discover MUT 1244 Threat Actor Targeting Security Professionals Through Multi-Vector Campaign

Researchers discovered MUT 1244, a sophisticated threat actor systematically targeting security researchers, academics, and offensive actors through multiple attack vectors including malicious npm packages, phishing campaigns, and trojanized tools 0:31.

Key Findings:

• Malicious npm package: The actor created "ox engine XML RPC" (typosquatting legitimate "XML RPC" package) containing a backdoor that exfiltrated nearly 400,000 credentials to a Dropbox account controlled by "Paul Müller 977" 1:41
• Second-stage payload: The malware downloaded additional code that deployed both a coin miner and an info stealer targeting cloud credentials (AWS, Azure), Electrum wallets, bash history, and SSH keys 1:41
• Academic phishing campaign: The actor scraped researcher emails from arXiv and sent fake CPU microcode update emails, directing victims to a malicious website that delivered the same payload 6:02
• Trojanized security tools: The attackers created "YOP," a WordPress credential validator tool targeting offensive actors. The tool used the malicious XML RPC package as a dependency and stole the very credentials it was supposed to validate 8:17
• Fake proof-of-concept repositories: The actor established credibility through fake CVE exploit repositories with detailed READMEs, which were promoted through SEO-optimized websites and social media accounts 15:03
• Cryptocurrency targeting: Evidence showed earlier operations targeting blockchain communities through a fake "token recovery" tool promoted on Medium, Quora, and Russian-lang