zod-pino

discovered 2026-05-26

zod-pino is a Wave 3 parallel package in the forge-jsx RAT campaign, published by rafael_silva (rafaelsilva19930303@gmail.com) on 2026-06-22. Poses as a zod/pino integration utility. Full Phase 5 RAT feature set identical to forge-jsx4. C2 rotated to 212.193.3.61 (same ports 9877/8765, same default password 'secret'). Durable directory hardcoded as .forge-jsxy (copy-paste OPSEC failure). First simultaneous multi-package operation: active at same time as forge-jsx4 and pino-zod.

Threat types

rat
credential stealer
data exfiltration
persistence
c2 agent
crypto drainer

Malicious versions

1.0.122
1.0.123
1.0.124
1.0.125 · 1f7616b3c38f8586…

Campaigns

forge-jsx RATattributed-to

Indicators

ipv4212.193.3.61communicates-with
urlws://212.193.3.61:9877communicates-with
urlhttp://212.193.3.61:8765communicates-with
sha2561f7616b3c38f85860abd9ae989d72915e9c13f0d106804471a811a38d63e5293indicates
emailrafaelsilva19930303@gmail.comindicates
file path~/.config/systemd/user/forge-js-worker.servicedrops
file path~/.config/autostart/forge-js-worker.desktopdrops
file path~/Library/LaunchAgents/com.forgejs.worker.plistdrops

Techniques

ttpT1195.002 Compromise Software Supply Chainuses
ttpT1059.007 JavaScriptuses
ttpT1547.001 Boot or Logon Autostart Execution: Registry Run Keysuses
ttpT1547.004 Boot or Logon Autostart Execution: Launch Agentuses
ttpT1543.002 Systemd Serviceuses
ttpT1056.001 Input Capture: Keylogginguses
ttpT1115 Clipboard Datauses
ttpT1113 Screen Captureuses
ttpT1005 Data from Local Systemuses
ttpT1567.001 Exfiltration to Code Repositoryuses
ttpT1071.001 Web Protocolsuses
ttpT1027 Obfuscated Files or Informationuses
ttpT1082 System Information Discoveryuses
ttpT1217 Browser Information Discoveryuses
ttpT1552.001 Credentials In Filesuses
ttpT1020 Automated Exfiltrationuses

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API