Axios RAT Deep Dive: Social Engineering Root Cause, OpenClaw Propagation, and the peinject Command Set Defenders Need to Know

Analysis

Datadog: How a Fake Microsoft Teams Call Gave Attackers the Axios npm Keys

The maintainer was social-engineered via a fake Slack workspace and Teams call into installing a RAT, which then harvested npm credentials. This is the XZ Utils playbook again: attack the human, not the code.

Elastic: The peinject Command and Cross-Platform RAT Architecture Behind the Axios Compromise

Elastic's teardown shows all three payloads share identical C2 protocol, command types, and a hardcoded IE8 user-agent, pointing to a single unified RAT framework. The peinject command enables reflective .NET loading on Windows and binary drops on macOS and Linux, giving operators persistent execution post-compromise.

News

Sonatype: OpenClaw Packages Spread the Same Malicious plain-crypto-js Dependency Beyond Axios

The attacker's technique propagated into @shadanai/openclaw and @qqbrowser/openclaw-qbot packages, showing this wasn't a one-target operation. If you only audited axios in your dependency tree, you may have missed it.

Detection

Qualys: UNC1069 Attribution and Detection QIDs for the Axios Supply Chain Attack

Google's GTIG ties this to UNC1069 via the WAVESHAPER.V2 backdoor, adding a second attribution track alongside Microsoft's Sapphire Sleet label. Qualys has detection coverage under QIDs 386943 and 5010006 for teams that need to scan now.

Mitigation

Microsoft: Remove Caret and Tilde from package.json Now to Block This Entire Attack Class

The single most actionable takeaway from Microsoft's writeup: swapping ^1.14.0 for an exact pinned version in package.json would have prevented auto-pull of the malicious release entirely. Pair that with npm ci --ignore-scripts and you eliminate the postinstall hook vector.