Actor Profile

PhantomSub is a supply chain campaign targeting software developers through malicious npm packages. The campaign abuses the Baileys WhatsApp open source project to add victims to WhatsApp groups and channels without consent. Attribution points to Indonesian-origin actors based on group content, language, and linked business accounts. The campaign appears financially motivated, using forced subscriptions to inflate follower counts for bot-selling services, in-game resource marketplaces (JualanRSS), and social media boosting operations. One identified business account is named "Dan" and advertises Mobile Legends and TikTok accounts.

TTPs (Tactics, Techniques, Procedures)

Initial access via malicious npm packages (T1195.001 - Supply Chain Compromise: Compromise Software Dependencies). The campaign deployed 101 trojanized Baileys forks with 490,000 total downloads. Three malware variants implement different obfuscation methods: Variant 1 fetches channel IDs from GitHub at runtime (T1102 - Web Service for C2), Variant 2 embeds cleartext channel IDs in source code, and Variant 3 uses encoded/obfuscated channel IDs. Execution occurs during package installation (T1059 - Command and Scripting Interpreter). The malware hijacks authenticated WhatsApp bot sessions to subscribe victims to attacker-controlled channels and groups (T1098 - Account Manipulation). Some variants inject advertising URLs into media sent by victim bots (T1565.002 - Data Manipulation: Transmitted Data).

Targets & Patterns

PhantomSub specifically targets software developers in the npm ecosystem who use or seek WhatsApp bot functionality via the Baileys library. The campaign exploits developers' trust in open source packages and their need for WhatsApp automation capabilities. Victims are primarily developers building WhatsApp bots who authenticate their personal or business WhatsApp accounts to the malicious packages. The threat actor benefits from each compromised developer account by gaining followers/subscribers to monetize through bot script sales, premium APK distribution, in-game resource sales (Mobile Legends resources via JualanRSS marketplace), and social media engagement boosting services. The Indonesian-language content in controlled groups suggests regional targeting or actor origin, though the npm supply chain attack has global reach with 116,000 downloads in the last 30 days alone.

Historical Context

PhantomSub activity was first identified in August 2026 by SafeDep, which discovered malicious Baileys forks forcing WhatsApp accounts to follow attacker-controlled channels and injecting advertising URLs into bot-sent media. In September 2026, Xygeni Security Research Team disclosed the "@dappaoffc/baileys-mod" package performing similar newsletter subscription abuse. OX Security's September 2026 analysis expanded the scope to 101 packages with shared infrastructure, revealing a coordinated campaign rather than isolated incidents. Multiple packages share channel IDs, remote channel lists, and GitHub accounts, indicating centralized control. The campaign demonstrates evolution in obfuscation techniques across three variants, suggesting ongoing development and OPSEC improvements by the operators.

Defensive Recommendations

  • Implement npm package vetting: scan dependencies for Baileys forks and block packages requiring WhatsApp account authentication during installation
  • Monitor for T1195.001 supply chain compromise: establish allowlists for legitimate Baileys packages and alert on typosquatted or unofficial forks in package.json
  • Detect T1102 runtime C2 behavior: monitor npm package installation scripts for outbound connections to GitHub raw content URLs or external channel ID fetching
  • Review WhatsApp account subscriptions: audit authenticated bot sessions for unauthorized group/channel memberships and implement application-level controls to prevent silent subscription actions
  • Apply dependency confusion defenses: use package lock files, verify package publishers, and employ tools like Socket Security or Phylum to detect malicious behavior in open source dependencies before deployment