Discord Controlled NodeCordRAT Steals Chrome Data via NPM Packages
8 January 2026 at 11:25
Zscaler ThreatLabz identifies three malicious NPM packages mimicking Bitcoin libraries. The NodeCordRAT virus uses Discord commands to exfiltrate MetaMask data and Chrome passwords.