PhantomSub (OX 28 Sep): 101 malicious npm Baileys forks auto-subscribe WhatsApp to spam channels (~490k downloads)
OX Security research (Nir Zadok, Moshe Siman Tov Bustan, Vitalii Chepurko; 28 September 2026; The Hacker News 29 Sep) tracks PhantomSub: 101 malicious npm packages impersonating/forking the Baileys unofficial WhatsApp API library so that when a developer links a personal WhatsApp account the package silently follows attacker-controlled WhatsApp channels/groups (follower inflation for Indonesian bot/account-selling spam). ~490,000 total downloads (~116,000 in prior 30 days); 16 packages removed from npm as of 28 Sep; campaign still growing (most packages first published Aug–Sep 2026). Three variants: (1) 19 packages fetch channel IDs from GitHub at runtime; (2) 60 embed channel IDs in cleartext; (3) 14 embed base64/obfuscated IDs or invite codes. Earlier related Baileys-mod findings: SafeDep (Aug), Xygeni (@dappaoffc/baileys-mod), OSV. Channels observed marketing Mobile Legends / TikTok accounts and in-game resources (e.g. “Dan” Indonesia business WhatsApp; Neural / MONTE–BMG / CORTANA TECH). Distinct from desk npm credential-stealer cards (PhantomRaven, WeaselBiscuit, tw-pkgprobe) — payload here is non-consent WhatsApp channel subscribe, not browser-password theft. Primary: OX PhantomSub; wire: THN 29 Sep.
- Product
- npm packages impersonating Baileys (WhatsApp Web API library) — PhantomSub campaign
- Versions
- n/a (malicious packages; 16 removed as of 28 Sep 2026; many still live — pin/audit Baileys-named deps; do not connect personal WhatsApp to untrusted packages)
- Exploited in Australia?
- unknown
- Patch to
- No CVE. Developers: audit Baileys / *baileys* npm deps; remove unknown forks; check WhatsApp Linked Devices and leave/block unexpected channels/groups; rotate WhatsApp-linked session credentials if a malicious package ran. Defenders: block package names/IOCs from OX report (remote channel-list GitHub URLs, channel JIDs, invite codes); warn teams never to connect personal messaging accounts to third-party npm automation libs.
Primary: OX Security — PhantomSub malicious npm Baileys / WhatsApp campaign (28 Sep 2026) · Vendor: OX Security Research (primary) · The Hacker News — 101 malicious npm packages add WhatsApp accounts to groups (29 Sep 2026)