Tsundere Botnet Exploits Node.js and Blockchain for Multi-OS Attacks

Tsundere Botnet Exploits Node.js and Blockchain for Multi-OS Attacks

First seen 2 Dec 2025, 18:33 UTC •SecurelistCybersecuritynews •80% similarity •24.1

Article Content

Browse articles
ThreatCluster

The Tsundere botnet, identified by Kaspersky GReAT in mid-2025, utilizes legitimate Node.js packages and blockchain technology to distribute malware targeting Windows, Linux, and macOS users. The threat is linked to malicious activity first observed in October 2024, involving typosquatting on popular Node.js packages to deliver payloads through the Node Package Manager (npm).

ThreatCluster AI How this analysis works

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

123 Stealer Tsundere Tsundere Botnet Ethereum Blockchain Linux MacOS Windows