Malware
StoatWaffle
StoatWaffle Malware is a lightweight JavaScript-based backdoor trojan active since at least October 2025 that enables persistent, stealthy remote control over infected systems by continuously beaconin
StoatWaffle is a JavaScript malware family.
Background
StoatWaffle is a compact JavaScript backdoor trojan seen in the wild since at least October 2025, granting attackers durable and covert remote control by beaconing to a command-and-control server roughly every 5 seconds. Its First-Stage Module fingerprints the host — gathering hostname, MAC address, OS details, and the full Node.js environment (process.env), which often holds cloud credentials, API keys, and CI/CD secrets — and runs attacker-supplied code through eval(). The Second-Stage Module goes further, capturing the victim's public IP, launching payloads as detached child processes via the local Node.js runtime, and offering process ID tracking, remote agent UUID and session token updates, plus an operator kill-switch that terminates all tracked child processes and self-exits on command. Both stages suppress SIGHUP signals and hide spawned process windows to stay quiet, relay errors to the C2 through a dedicated telemetry endpoint, and collectively let attackers steal secrets, push further payloads, run arbitrary commands, and hold process-level control under the compromised user's privileges.
Source: Malpedia (Fraunhofer FKIE).