Executive Summary
In late September 2026, CloudSEK identified a supply-chain campaign named NEBULA, where a threat actor deployed seven malicious npm packages posing as 'NebulaAI' SDKs. These packages target developers and build systems on Windows platforms. The infection is triggered by an obfuscated 'preinstall.cjs' hook that executes before code review can occur, dropping a modified version of the KNTRAT remote-access trojan (RAT).
The technical novelty of this campaign lies in the KNTRAT payload, which operates exclusively via direct NT and win32k syscalls. By bypassing standard DLL imports like kernel32.dll and user32.dll, the malware maintains an empty Import Address Table (IAT), effectively evading many EDR and antivirus solutions. The RAT provides full interactive control, including hidden-desktop (HVNC) sessions, camera/microphone monitoring via Kernel Streaming, and persistence through Winlogon Shell modifications.
This campaign highlights the increasing risk of opportunistic supply-chain attacks targeting fashionable technologies like AI. Organizations should immediately block the associated C2 infrastructure and audit their npm environments for unauthorized lifecycle scripts.