Lotusbail Malware — Analysis, Campaigns & Threat Activity

Related Threat Clusters

• Malicious NPM Package Steals WhatsApp Data from 56,000 Users

  A malicious NPM package named 'lotusbail' has been downloaded over 56,000 times and is stealing WhatsApp messages and user data from developers worldwide. Disguised as a legitimate WhatsApp Web API library, it operates…

  4 articles · Updated December 23, 2025
• Malicious npm Package Steals WhatsApp Accounts and Messages

  A malicious npm package named lotusbail, masquerading as a WhatsApp Web API library, has been found to steal WhatsApp messages, credentials, and contacts. This package has been available for at least six months and has…

  5 articles · Updated December 22, 2025

Recent Intelligence Reports

• WhatsApp API worked exactly as promised, and stole everything — Csoonline · December 23, 2025
• Malicious NPM Package with 56K Downloads Steals WhatsApp Messages — Cybersecuritynews · December 23, 2025
• Poisoned WhatsApp API package steals messages and accounts — Theregister · December 22, 2025
• Malicious npm package steals WhatsApp accounts and messages — Bleepingcomputer · December 22, 2025

Related Entities