Kiran 
A trojanized Terraform provider is infecting developer machines with cross-platform malware, according to Zscaler ThreatLabz.
The campaign, discovered in July 2026, is suspected to be the work of North Korea-linked TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima and Slow Pisces).
The initial payload is a Go binary named terraform-provider-awsbeta_v1.0.0, which masquerades as an AWS provider. Terraform providers are executable plugins, so they run on developer workstations and CI/CD systems. That makes cloud engineers and developers likely targets. How the provider reached victims is still unclear.
TraderTraitor Hackers Use Fake Terraform Provider
The attackers added a malicious package called awsbeta and called it directly from main. The malicious code therefore runs as soon as Terraform starts the provider.
A session.lock file in the temp directory acts as a run-once marker. The provider then downloads a Bash payload named safari_updater from the lookalike domain hashicorp-terraform[.]io and launches it as a detached process. Meanwhile, the provider keeps behaving normally, so the compromise is harder to notice.
The Bash loader works on macOS, Linux, and Windows systems running Unix-like shells such as Cygwin, MinGW, or MSYS. It builds a filename from the operating system and CPU architecture, for example HiraginoSans-Regular.woff for an ARM64 Mac. The resulting files look like ordinary web fonts.
Each .woff file contains decoy font data, then the marker @@ENDFONT@@, then an encrypted executable. The loader decrypts it with AES-256-CBC using Python, Node.js, Perl, or OpenSSL, whichever is installed.
It tries three sources in turn: a dynamic DNS host, a GitHub repository, and a Vercel-hosted site. On macOS, it also strips the quarantine attribute and applies an ad hoc code signature.
Payloads are dropped in locations that imitate legitimate components:
| Platform | Payload path |
|---|---|
| Linux | $HOME/.config/git/update |
| macOS | $HOME/Library/com.apple.iTunesCloud/SystemUpdate |
| Windows | $HOME/AppData/Local/Microsoft/Edge/service.exe |
The delivered FLATROOF variant is a Rust-based backdoor with platform-specific persistence. It uses a service on Linux, a zlogout mechanism on macOS, and a registry Run value on Windows. For command and control, it supports three channels:
- Telegram Bot API
- GitHub API polling
- An attacker-controlled HTTP webhook
Embedded Python scripts steal browser credentials, cookies, history, autofill data, terminal history, and system details. Platform-specific targets include:
- Linux: the Chrome Safe Storage secret and keyring files.
- macOS: Safari data and the login keychain.
- Windows: Credential Manager entries and extensions for MetaMask, Phantom, Trust Wallet and Rabby.
The Windows script also injects a native payload into a suspended Chromium process to recover browser master keys. Researchers noted verbose comments, emojis, and inconsistent naming in the scripts. They suggest an LLM may have helped write or modify the code.
FLATROOF ultimately drops the ROOFDECK backdoor, which has Windows and macOS variants. It finds its C2 server in layers. It first checks a local configuration file.
It then fetches a Pastebin file holding an encrypted address and an RSA signature. It verifies that signature before trusting the address, so a third party can’t redirect infected hosts.
If Pastebin fails, ROOFDECK reads profile metadata from Nostr to find the current Pastebin URL. Its features include reverse shell access, file operations, clipboard access, and self-destruction.
The campaign overlaps with the earlier KelpDAO incident, which involved the same two malware families. SentinelLabs independently reported related activity.
ThreatLabz found strong overlaps in tactics and targeting with TraderTraitor. It found no unique code, infrastructure, or cryptographic links to attribute the campaign to the group with high confidence.
Defenders should restrict untrusted Terraform providers, verify provider checksums, and watch for unexpected process activity on developer systems. They should also block the lookalike domain and review outbound connections from build environments to Telegram, GitHub, Pastebin, and Nostr relays.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
1 thought on “TraderTraitor Hackers Use Fake Terraform Provider to Spread Cross-Platform Malware”