Bleepingcomputer

Malicious npm Package Steals WhatsApp Accounts and Messages

First seen 22 Dec 2025, 23:57 UTC • Bleepingcomputer

•85% similarity •25.0

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A malicious npm package named lotusbail, masquerading as a WhatsApp Web API library, has been found to steal WhatsApp messages, credentials, and contacts. This package has been available for at least six months and has accumulated over 56,000 downloads. It functions as a legitimate API while harboring sophisticated malware that compromises user accounts.

ThreatCluster AI How this analysis works

Attack Flow

9 entities, 9 inferred relationships (STIX 2.1).

Technique (2)

Malware
Supply Chain Attack

Campaign (1)

Tea Token Farming Campaign

Malware (1)

Lotusbail

Affected Platform (3)

WebSocket
WebSockets
WhatsApp

Tool (2)

Npm
Baileys

Relationships

Tea Token Farming Campaign uses Lotusbail
Malware targets WebSocket
Malware targets WebSockets
Malware targets WhatsApp
Supply Chain Attack targets WebSocket
Supply Chain Attack targets WebSockets
Supply Chain Attack targets WhatsApp
Tea Token Farming Campaign related to Npm
Tea Token Farming Campaign related to Baileys

Community

Browse all →

Tracked Entities in This Story

Lotusbail Tea Token Farming Campaign WebSocket WebSockets WhatsApp

Malicious npm Package Steals WhatsApp Accounts and Messages

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story