Axios RAT: Elastic's Cross-Platform Teardown, Datadog's Account Takeover Forensics, and the IE8 User-Agent That Gives It Away

Analysis

Elastic Security Labs: Three Platform Variants, One RAT Spec

Elastic's teardown is the most technically complete analysis published so far. The key finding: all three stage-2 payloads share an identical C2 protocol, command set, and a hardcoded IE8/Windows XP user-agent string that is trivially detectable on any modern macOS or Linux host. That single IOC is your cheapest detection win.

Datadog Security Labs: How the npm Account Takeover Is Visible in Registry Metadata

Datadog shows exactly how to spot the compromise forensically: the publisher shifted from GitHub Actions OIDC to a direct CLI session, and the maintainer email changed to an attacker-controlled Proton address between versions 1.14.0 and 1.14.1. This is a reusable detection pattern for any future compromised npm maintainer.

Sonatype: OpenClaw Packages Spread the Same Backdoor Beyond Axios

Sonatype identified four additional npm packages outside the Axios dependency tree carrying the same plain-crypto-js backdoor, including packages under the @shadanai and @qqbrowser namespaces. This is the clearest evidence yet that the attacker was running a broader campaign, not just a single high-profile hit.

SANS: TeamPCP IAB Theory and Practical Blue Team Checklist

SANS connects the Axios attack to the earlier TeamPCP campaign targeting Trivy, LiteLLM, and Telnyx, and floats the theory that TeamPCP is operating as an initial access broker selling stolen publisher credentials. The blue team artifact checklist and CI/CD scope guidance are worth bookmarking regardless of attribution.

News

Microsoft Threat Intelligence: Sapphire Sleet Attribution and Full Mitigation Runbook

Microsoft formally attributes the Axios compromise to Sapphire Sleet, the North Korean actor focused on crypto theft, and provides a detailed mitigation checklist including exact package.json lockdown syntax and CI/CD hardening steps. If you need something to hand to your team today, this is the doc.