Famous Chollima MicrosoftSystem64 RAT Abuse of HuggingFace

In early 2026, the DPRK-linked actor FAMOUS CHOLLIMA (also known as Contagious Interview) launched a sophisticated supply chain campaign targeting developers and cryptocurrency traders. The operation uses a cluster of malicious npm packages, such as `js-logger-pack` and `terminal-logger-utils`, to drop a multi-platform remote access trojan (RAT) named MicrosoftSystem64. This binary is packaged as a Node.js Single Executable Application (SEA), allowing it to run cross-platform while evading traditional detection.

The campaign's most notable innovation is the abuse of HuggingFace as a dual-purpose infrastructure: acting as a CDN for binary updates and a stealthy exfiltration backend for stolen data via the Git LFS API. This allows the attacker to bypass network defenses that typically allow traffic to legitimate machine learning platforms. The threat remains active, with live probes confirming ongoing surveillance of victims including near real-time screenshot captures and massive exfiltration of credential databases, SSH keys, and over 80 cryptocurrency wallet extensions.

This activity represents a high-risk threat to organizations involved in software development, decentralized finance (DeFi), and cryptocurrency trading. The actors demonstrate rapid operational resilience, rotating npm accounts and HuggingFace tokens immediately following industry disclosures.