pino-zod

discovered 2026-05-26

pino-zod is a Wave 3 parallel package in the forge-jsx RAT campaign, published by rafael_silva (rafaelsilva19930303@gmail.com) on 2026-06-22. Poses as a pino/zod integration utility. Full Phase 5 RAT feature set identical to forge-jsx4. C2 rotated to 212.193.3.61 (same ports 9877/8765, same default password 'secret'). Durable directory hardcoded as .forge-jsxy (copy-paste OPSEC failure). First simultaneous multi-package operation: active at same time as forge-jsx4 and zod-pino.

Threat types

rat
credential stealer
data exfiltration
persistence
c2 agent
crypto drainer

Malicious versions

1.0.121
1.0.122 · 0eb72e0794c7e51c…

Campaigns

forge-jsx RATattributed-to

Indicators

ipv4212.193.3.61communicates-with
urlws://212.193.3.61:9877communicates-with
urlhttp://212.193.3.61:8765communicates-with
sha2560eb72e0794c7e51ca1d790c443b5f573e1288bad6e6c56d1bd9c4b69a71d65d0indicates
emailrafaelsilva19930303@gmail.comindicates
file path~/.config/systemd/user/forge-js-worker.servicedrops
file path~/.config/autostart/forge-js-worker.desktopdrops
file path~/Library/LaunchAgents/com.forgejs.worker.plistdrops

Techniques

ttpT1195.002 Compromise Software Supply Chainuses
ttpT1059.007 JavaScriptuses
ttpT1547.001 Boot or Logon Autostart Execution: Registry Run Keysuses
ttpT1547.004 Boot or Logon Autostart Execution: Launch Agentuses
ttpT1543.002 Systemd Serviceuses
ttpT1056.001 Input Capture: Keylogginguses
ttpT1115 Clipboard Datauses
ttpT1113 Screen Captureuses
ttpT1005 Data from Local Systemuses
ttpT1567.001 Exfiltration to Code Repositoryuses
ttpT1071.001 Web Protocolsuses
ttpT1027 Obfuscated Files or Informationuses
ttpT1082 System Information Discoveryuses
ttpT1217 Browser Information Discoveryuses
ttpT1552.001 Credentials In Filesuses
ttpT1020 Automated Exfiltrationuses

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API