Axios Attack Aftermath: What Microsoft, Wiz, and Orca Found Under the Hood

Analysis

Microsoft Attributes Axios npm Compromise to North Korean Sapphire Sleet Actor

Microsoft Threat Intelligence formally attributed the axios npm RAT to Sapphire Sleet, a North Korean state actor, linking C2 infrastructure to known campaigns. If your team ran npm install between March 31 and April 1, treat all secrets from that environment as compromised and rotate immediately. microsoft.com

Wiz: Axios Was Present in 80% of Cloud Environments, Executed in 3% During the Window

Wiz scanned their cloud visibility data and found axios in roughly 80% of cloud and code environments, with confirmed payload execution in 3% of those during the short exposure window. The GHSA tracking number is GHSA-fw8c-xr5c-95f9 if you need to grep your advisories or SCA tooling. wiz.io

IronPlate: How the Axios Maintainer Account Was Hijacked and Why CI/CD Didn't Catch It

IronPlate reconstructed the full attack timeline including how the attacker bypassed GitHub Actions OIDC Trusted Publisher by publishing manually with a stolen long-lived npm token. The poisoned versions never appeared in the GitHub repo, so any watch on the source code repo gave you zero signal. ironplate.ai

Phoenix Security: The RAT Swept SSH Keys, AWS Credentials, and Kubernetes Tokens in 15 Seconds

Phoenix Security's breakdown details what the cross-platform RAT actually exfiltrated: SSH keys, AWS, GCP, Azure credentials, Kubernetes tokens, .env files, shell history, and crypto wallets, all encrypted with AES-256-CBC and RSA-4096 before exfil. Traditional CVE scanners will not flag this since no CVE was assigned, which is the real long-term problem. phoenix.security

Tools

Orca Security: Full Remediation Guide Including Package Hashes and Detection Commands

Orca's writeup is the most actionable remediation reference out there right now, covering package hashes for detection, host-level indicators, and version-specific rollback instructions. If you are running triage, start here before anything else. orca.security