Overlord RAT

Reported Context (2)

Three of the packages, "tlxbnhd," "tldriver," and "mxdriver," act as Overlord RAT loaders, with the malicious code triggered via lifecycle hooks to download and run a Windows executable. MALFEX npm Campaign Delivers Overlord RAT and Stealers Through Eight Malicious Packages
endpoint could expose access across the business: DestinyStealer, Banana RAT, DARTHVADER Stealer, and OVERLORD RAT collected or targeted browser credentials, cookies, Outlook data, VPN access, file-transfer accounts, July 2026 Attacks Targeted US, European and Brazilian Organizations with Phishing and Malware

CVE (2)

Malware (6)

MITRE ATT&CK (3)

Vendors (2)

Products (11)

Tools (2)

Industries (9)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.