Supply‑Chain RAT MicrosoftSystem64 Leverages HuggingFace to Steal Data
Researchers uncovered MicrosoftSystem64, a cross‑platform RAT delivered via the npm js‑logger‑pack supply‑chain. The payload uploads stolen browser credentials, crypto wallets, and other data to public HuggingFace dataset repositories, bypassing traditional C2 controls. The campaign also supports Windows, macOS and Linux, and includes keylogging, screenshot capture, and SSH key harvesting.