StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer

Date (as written): 2026-02-27T14:18:40.511Z
Year: 2026

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Developers generally in the crypto space · 26/02/2026

Socket researchers identify "StegaBin," an additional interaction of the "Contagious Interview" campaign involving 26 malicious npm packages using steganography to hide malicious payloads in Pastebin. This sophisticated method evades traditional detection, allowing the malware to exfiltrate sensitive data from developers' environments while appearing as harmless dependency updates. [Date Occurred: 25/02/2026 and 26/02/2026; Date Discovered: 25/02/2026 and 26/02/2026]

https://www.hackmageddon.com/2026/03/06/16-28-february-2026-cyber-attacks-timeline/

https://thehackernews.com/2026/03/north-korean-hackers-publish-26-npm.html

Socket.dev blog

StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer · 2026-02-27T14:18:40.511Z

Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

https://socket.dev/blog/stegabin-26-malicious-npm-packages-use-pastebin-steganography

Suggest a correction on GitHub