#ParsedReport #CompletenessLow
07-10-2026

PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels

https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/

Report completeness: Low

Victims:
Npm developers, Whatsapp users

Geo:
Indonesia, Indonesian

ChatGPT TTPs:
do not use without manual check
T1027, T1102

IOCs:
File: 2
IP: 0
Domain: 0
Url: 0
Hash: 0
Email: 0
BrowserExtension: 0

Soft:
WhatsApp, TikTok, Telegram

Algorithms:
base64

Links:
https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP\_Push.json