SStar Agent is an Iru-discovered, Go-based cross-platform remote access trojan (RAT) delivered through a poisoned npm package that provides persistent surveillance, host reconnaissance, and data exfiltration, with a fully implemented Windows toolkit and an unfinished macOS feature set.

Symptoms

You might observe the following artifacts associated with this threat:

• Persistence Artifacts (macOS): A LaunchAgent plist at ~/Library/LaunchAgents/com.wpnuersvc.agent.plist (arm64) or com.googleupdate.sstaragent.plist (x86_64) with RunAtLoad and KeepAlive set to true, plus a stable binary copy at ~/.local/share/wpnuersvc-agent/WpnUserSvc.
• Persistence Artifacts (Windows): An executable dropped to the Startup folder at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\GoogleUpdateService.exe, running headless at every login without elevated privileges.
• Suspicious Temp / Debug Files: Short-lived sstar-*.cmd files in %TEMP% created per shell command (Windows), a sstar-agent-error.txt error log in the executable directory, and an operator agent.env config file.
• Anomalous Network Activity: Recurring HTTPS POST beaconing to api.otter-stack.com (JSON telemetry and command polling), plus public-IP lookups to api.ipify.org.
• Suspicious Background Processes: Headless binaries masquerading as system or updater services (WpnUserSvc, GoogleUpdateService.exe, com.wpnuersvc.agent, com.googleupdate.sstaragent) that impersonate Windows services or browser update infrastructure.

Technical Breakdown

SStar Agent is a statically linked Go RAT built for macOS (arm64 and x86_64) and Windows (amd64), self-identifying as "SStar agent" in on-disk error messages. It communicates with api.otter-stack.com, a domain registered in April 2026 whose root hosts an operator web console.

The infection chain begins with social engineering: a fake Web3 engineering take-home assessment hosted in a clean-looking GitHub repository ("ChainQuest") that imports a poisoned npm package, tw-style-utils version 0.7.1, published by the maintainer "superstar777." The package masquerades as a Tailwind CSS typography plugin while appending an XOR-obfuscated downloader to its source. Because the payload fires at build time rather than install time, npm install --ignore-scripts offers no protection. The downloader detects OS and architecture, fetches a platform-specific build, writes it to the temp directory under a disguised name, and spawns it detached from the parent process. This is the fourth documented iteration of the same fake-interview delivery pattern.

Once running, the agent copies itself to a stable path and registers persistence — via launchctl bootstrap on macOS, or Startup-folder placement on Windows — then runs two permanent HTTPS loops: a command-poll loop on a 20–60 second interval and a telemetry loop on a 45–160 second interval that ships the Chrome extension inventory, home-directory filesystem tree, hostname, and public IP on every tick.

Some of SStar Agent's primary capabilities include:

Chrome Extension Harvesting: Enumerating every installed Chrome extension and exfiltrating the full inventory with each beacon; the operator can then pull any extension directory as a zip.

Filesystem Reconnaissance and Exfiltration: Collecting a recursive tree of the victim home directory, then zipping arbitrary paths in memory and uploading them in reassembled chunks.

Shell Command Execution: Running a small built-in command set and falling through to /bin/sh on macOS or a cmd.exe-executed batch file on Windows.

Keylogging and Clipboard Monitoring (Windows only): Capturing keystrokes and clipboard contents tagged with the active window title, flushed on a 12-second interval.

Remote Input Control (Windows only): Moving and clicking the mouse and injecting keystrokes into the foreground window.

Notably, the keylogging, clipboard, and screen-capture functions exist in the macOS builds but are empty stubs, while the Windows build implements the first two fully — indicating the toolkit is still under active development. Behavior is heavily configurable through an agent.env file exposing roughly fifteen environment variables, suggesting coordinated per-target deployment.

Get a more in-depth breakdown of SStar Agent with a write-up by Iru security researchers here.

Next Steps

Behavioral Endpoint Detection & Response (EDR) is recommended to catch SStar Agent's runtime activity — LaunchAgent and Startup-folder abuse, headless binaries impersonating system/updater services, sstar-*.cmd batch execution, keyboard/clipboard capture on Windows, and recurring JSON beaconing to api.otter-stack.com. Affected hosts should have the persistence artifacts removed (the LaunchAgent plists and stable binary on macOS; the Startup-folder executable on Windows), and credentials, browser data, and secrets reachable from the compromised endpoint should be rotated, since the implant continuously exfiltrates Chrome extension data and filesystem contents.

In the future, treat unsolicited technical interviews, take-home assessments, and bounty projects delivered via developer channels with caution, and audit npm and other third-party dependencies before building — noting that build-time payloads bypass --ignore-scripts. Pin dependencies to fixed versions rather than "latest," obtain software only from trusted official sources, and use professional security monitoring to audit process and network activity, as this malware is designed to blend into normal process and file listings.