Sapphire Sleet's Axios RAT: Microsoft's Full Kill Chain and What Your Team Still Needs to Patch

Analysis

Microsoft Formally Attributes Axios npm Compromise to North Korean Sapphire Sleet

Microsoft Threat Intelligence pinned the Axios RAT campaign to Sapphire Sleet, a North Korean state actor with a history of targeting crypto and finance. The post includes the full C2 infrastructure breakdown, OS-specific payload chains, and the registry run key used for Windows persistence — the most authoritative technical writeup published so far.

Orca Security's Axios Attack Breakdown: Phantom Dependency, Anti-Forensics, and Full Remediation Steps

Orca reconstructs the exact minute-by-minute attack timeline and explains how the self-erasing package.json swap made post-incident inspection nearly useless. The remediation table is the most actionable version-by-version guide available, including what to do if you confirmed RAT artifacts on a host.

SANS Ties Axios Compromise to TeamPCP Campaign and Warns of Ongoing IAB Activity

SANS analysts connect this attack to TeamPCP, the same group behind compromises of Trivy, KICS, LiteLLM, and Telnyx over the prior two weeks, and float the hypothesis that they are operating as an Initial Access Broker selling footholds to other actors. If that read is correct, the Axios hit is not a one-off and more high-download packages are likely already targeted.

IronPlate Connects the Axios RAT to Agentic AI Risk: Why AI Coding Agents Make Supply Chain Attacks Worse

This piece draws a direct line between the Axios compromise and AI coding agents like Claude Code and Cursor that run npm install autonomously, meaning the RAT could deploy with zero human approval in the loop. Worth reading if your team uses any AI-assisted dev tooling or MCP servers in local environments.

News

Snyk Details Two Additional Compromised Packages Beyond Axios in the Same Campaign

Snyk flagged that @qqbrowser/openclaw-qbot and @shadanai/openclaw were also shipping the malicious plain-crypto-js dependency, widening the blast radius beyond the core axios versions. Their guide also covers Bun lockfile inspection, which most other writeups skip entirely.