PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels

OX Security blog author avatar thumbnail displayed in the byline of vulnerability disclosure and CVE advisory postsNir Zadok,OX Security blog author avatar thumbnail displayed in the byline of incident analysis and supply chain attack writeupsMoshe Siman Tov Bustan&Vitalii ChepurkoVitalii Chepurko
September 28, 2026
15 min read
PhantomSub Malicious campaign secretly adds users to WhatsApp spam channels (3)
Share

490K downloads, quiet follower inflation, and a mysterious Dan from Indonesia. OX Research is tracking a malicious npm campaign making spam accounts look legitimate. The attackers use Baileys to silently make developers follow spam channels on WhatsApp.

Overview

The OX Research team identified 101 npm packages as part of a malicious WhatsApp group subscriber campaign. The malicious packages abuse the “Baileys” WhatsApp open source project to add the victims to groups without their consent. 16 of those packages were removed from npm as of September 28, 2026.

Earlier reports of Baileys WhatsApp campaign were made by SafeDep, OSV and Xygeni back in August and September 2026. Baileys is an open source project containing an unofficial implementation of the WhatsApp API used by developers to automate actions through their WhatsApp accounts – such as customer support bots, chat managers or data scraping. 

During our analysis, we found that one of the WhatsApp channels originated in Indonesia, and are advertising selling TikTok accounts and “Mobile Legends: Bang Bang” accounts.

Our analysis also shows that the campaign is continuously growing. Most packages in this report were first published in August and September 2026, new ones are still appearing, and most are still live on npm. Together they have about 490,000 downloads, 116,000 of them in the last 30 days.

OX Customers

Protection is provided through malicious dependency vetting – more details at the end of this report.

General recommedations

  • If you were added to one of those scam WhatsApp groups, report the group and block it.
  • Do not engage with any of those users, even if buying a TikTok account with 7K followers seems like a bargain, these sellers can take your money and disappear.
  • Add detection rules for blocking the malicious npm Baileys packages
  • Do not use any package that asks you to connect your private accounts (such as WhatsApp)
  • Add the remote channel-list URLs, channel JIDs and invite codes from the IOCs to threat-intelligence and URL-reputation pipelines.


Technical Analysis

Variants

Our analysis focuses on three main variants of the same WhatsApp group subscription malware, each with their own design choices, getting the list of WhatsApp groups to subscribe to remotely or locally, and their different ways of handling the subscription logic.

The packages share one basic payload – but differ in where the channel list comes from and how hard they try to hide it.

We grouped them into three variants:

  1. Scam channels IDs lists fetched remotely from GitHub at runtime
  2. Scam channels IDs sitting in cleartext inside the code
  3. Scam channels IDs encoded and obfuscated inside the code

Variant 1 – Fetching Remotely From GitHub (19 packages)

The threat actor hosts the WhatsApp scam group list on GitHub, so these channels could change dynamically without releasing a new npm version each time.

The same package name template appears in `cantarella-baileys`, `levvleys`, `yonzofficial`, `noxleyss` and their scoped twins; only the URL differs.

cantarella-baileys@1.1.13/lib/Socket/newsletter.js :

image
image

In @rixxcodex/baileys@9.0.0/lib/Utils/messages-media.js the URL is base64-encoded and hidden in media-download code:

image
image

The string decodes to `skyzopedia/Screaper/refs/heads/main/idChannel.json`, which lists 23 live channels.

Variant 2 – Hardcoded In Cleartext (60 packages)

In this variant, the IDs for the channels are hardcoded in cleartext inside the malware’s code

For example from jexkcode@1.1.2/lib/Utils/auto-follow.js :

image
image

Two packages added the code inside a bulk of code where most code reviewers could potentially miss:

@kanaraa/baileys@3.5.2/lib/Socket/messages-recv.js adds follow and mute to upstream’s own connection handler

image

@lekzo/baileys@0.0.8/lib/Signal/Group/Protocols.js puts a copy of the newsletter module inside a Signal-protocol file name.

image

Variant 3 – Hardcoded And Obfuscated (14 packages)

In this variant, most WhatsApp channel IDs are hardcoded and encoded using Base64 inside the code. 

For example – spencer-baileys@1.0.4/lib/Socket/newsletter.js base64-encodes a JSON list of invite codes, resolves each to a channel, then follows it after 90 seconds.

image

One additional package, neuralwhatsapp, resolves its target from a hardcoded WhatsApp invite code (0029VbBv6cUInlqLc5H0Kw0K) at runtime instead of storing a channel ID directly — the invite resolves to a channel named “Neural” with 798 followers. Seven other packages in this report (@web2apk/baileys, dilxztech, kiki-baileys, saturn-bail, anuaja, noxxleys, kasabaileys) were removed from npm before their code could be reviewed, so which variant they used is unknown.



Threat Intel Analysis

Inside the spam groups

During our analysis, we found that one of the groups is Indonesian based, and tends to sell accounts for mobile games and applications.

Selling a TikTok account with 7K followers:

image (21)

Selling accounts for the “Mobile Legends: Bang Bang” game:

image

The phone number in these messages is linked to an Indonesian business WhatsApp account named “Dan”

image

image (3)

Another group we found called “Neural”, with 798 followers – posts a game-currency “RSS SALES” announcement promising a “refund” for incomplete orders and telling buyers to contact an admin directly. “JualanRSS” (Indonesian for “selling RSS/resources”) signs the post – the same resource/account-selling pattern as the rest of this campaign, this time for a different mobile game:

image

Another group – “MONTE – BMG”, with 1K followers posts what looks like a screenshotted Arabic-language sales negotiation that ends in a group invitation and a further WhatsApp channel link.

This is the funnel in action: the inflated follower count is the bait, the actual deal moves to a private group:

image

That channel link resolves to a small, brand-new channel (stylized name “ISAGI”, 12 followers) whose own description contains a direct chat.whatsapp.com group-invite link – a possible next hop in the same funnel.

Analyzing The Bulk Of Channels

The channels we could identify are mostly small bot-seller and “market” channels, largely Indonesian, where follower counts serve as social proof for selling bot scripts, bot-building services, “premium” APKs and social-media boosting. Three are confirmed auto-follow targets; the rest are channels the package authors promote in their READMEs or code, and so most likely the same people who receive the hijacked followers.

AvatarChannel (preview name)FollowersWhat it showsWhere it appears
Savage Tech (0029VbCuEBJEAKWOWVH3G21e)114“SAVAGE TECH NETWORK” banner linking a GitHub repoAuto-follow target in spencer-baileys (base64 JSON)
I LOVE YOU (0029VbBYFdCE50Uoh5O7Jy2j)2.4KLove and relationship quotes, with a “join our tech…” link; a generic lifestyle channel used to collect followersAuto-follow target (ch1) and README in cortana-md-engine
CORTANA TECH (0029VbC173IDDmFVlhcSOZ0Q)1.3K“Official Cortana link”, points to thecortana.techAuto-follow target (ch2) in cortana-md-engine
Fyxzpedia.ID – Utama (0029VbBouHp0rGiGXagM0f2e)4.8KSells WhatsApp and Telegram bot scripts, bot-building and fix-a-feature servicespostinstall banner of @fyxzpediaa/baileys
Nyzz Market Official I-V, TESTI, OFFICIAL INFO (8 channels)4-15 eachA shop’s storefront, testimonial and info channelsREADME of @nyzzpediaa/baileys-new, which also auto-follows 8 hardcoded channel IDs (probably the same 8; not verified, since IDs have no public preview)
Wanz Lonely (0029Vb0A6XC3WHTORDf0Pn3V)70Sells “premium” APKs via a MediaFire download (AUTO_ORDER_APK_PREM.apk) and social-media boosting ordersREADME of @wanzlonely/bails4u
MR. SUPUN FERNANDO X (0029Vb55cv41nozBTTIw1y07)1.5KTech, coding and AI-tools promotionREADME of @mr-supun-fernando/supunmd-bail
Stylized name, “Redes Oficiales” (0029Vb5Z9SjIXnlvl97EQm2i)19KSpanish-language creator channel linking YouTube @Teiru44README of my-auto-follow
NIXCODE (0029VbCV1ck8fewpdNb2TY2k)1KDeveloper contact and a group inviteMessage-template code in zero-baileys
Fgsi Dev (0029VapkSr45q08hPPPVqy26)1.1KDeveloper “FongsiDev” contacts (Telegram dashmodz)Message-template code in zero-baileys
FLUX-CORP (0029Vb7Lbw76LwHcPKCkvg2S)152No descriptionREADME of @ostyado/baileys
AboutZaa.Env (0029VbBc5ak3AzNL2pXnJJ1u)296ASCII art onlyREADME of @mivesensei/baileys
Reviza suami hoshii (0029Vb7xLulDJ6GrrJGtU51t)74ASCII art onlyREADME of @mivesensei/baileys, @revizahoshii/baileys
INFORMATION BOT ITSUKI (0029Vag9VSI2ZjCocqa2lB1y)94Bot group inviteExample file of @queenanya/baileys (no auto-follow)
ALANNXD / HOLOW (0029Vb3IiqTL7UVP9A9n0w1x)10K“Official Channel – AlannXD”README of neuralwhatsapp
NexusBot Official channel (0029VbBK53XBvvslYeZlBe0V)6.4KOfficial channel of the NexusBot projectREADME of @nexustechpro/baileys and @dexterid/baileys
System CHANNEL (0029VaqUb9aGk1FxqeKKOd2i)1.4KStylized name; the description is decorative textREADME of @systemzero/baileys
noxleyss info X share code (0029VbD8x4q1dAw0XWN7wF0L)766“noxXza Info & baileys updates”README of noxleyss
About Fhkryy / Information Kaelpedia & DropByte (0029Vb6PTBx4IBhI4YkAsQ0p)462“Welcome To My Whatsapp Channel”Code (lib/index.js) of @fhkryxv/baileys
SaaOfc’s (0029VbBJKfE0gcfCAJZEVh3R)290No real description (“hii”)README of @saazkira/baileys
INFORMATION YUDZ DEV (0029VbA78K82f3EGd78yGU28)197“YUDZXML OFFICIAL”README of @yudzxml/baileys
SAURUS INFORMATION (0029Vb8g2ZyH5JLykgHzVu2g)121Name says “information about APKs/web” (Indonesian)Code (lib/index.js) of saurustheking and sauruskyah-baileys
Stylized “bot-jenne” (0029VazMIDf5a24D7Tjiaw04)94Stylized name; the description is decorative textREADME of @felixneo/baileys
@ramadanny / github.com/ramadanny (0029Vb7JPWCAInPfKWC14s2V)51“Official channel ramadanny”README of noxleyss and @maulenv/baileys
Astra Digital Information (0029VbCsoB0H5JLxG7J1CU31)n/aInformation channel; the preview shows no descriptionREADME of @astracode/byles-new


Shared Infrastructure

Many packages in this campaign are not independent. The same channel IDs, the same remote channel lists, and the same GitHub accounts appear across packages with different names and publishers. A shared channel means a shared beneficiary: whoever owns the channel collects followers from every package that targets it, whoever published the package.

  • 32 channels are followed by more than one package.
  • The most reused channel is 120363400911374213@newsletter. It is followed by 10 packages: @fazzcodestudio/wa-web, @japofc/baileys, @vanzxy/baileys, cloud-baileys, itsmeeaizat-bailey, luoxy-baileys, mikuhostt-baileys, oktz-baileys, ourin-baileys and rafael-bails.
  • The channel 120363427430697245@newsletter is followed by 8 packages: @bellaxchuu/flowblue, @bellaxchuu/privatebails, @bellaxchuu/teambails, @ikyyjee/ikyysinggle, @ikyyjee/ikyysingle, @wanzlonely/bails4u, @xayz/baileys and my-baileys.
  • The channel 120363400362472743@newsletter is followed by 5 packages: @badzz88/baileys, @bellaxchuu/xtrxbails, @sakataoffc/baileys, kurobails and noverojs.
  • One remote list feeds five packages. The list is skyzopedia/NewsletterID/VIP_Push.json. It is fetched by @fyxzpediaa/baileys, @modss/baileys, @rixxcodex/baileys, @sanzoffc/baileys and kiyoramarkets.
  • Other remote lists are shared within package families.
  • The list LevviCodeID/Levi4than/levvleys.json is used by levvleys, @levvicode/baileys and @ikanngeming/ikannbail.
  • The list noxXza/data/noxleys.json is used by noxleyss, @noxleyss/baileys and baileys-xbats.
  • The list iyedahruss/all-public-db/newsletter.json is used by saurustheking, sauruskyah-baileys and luoxy-baileys.
  • Operators publish the same code under near-identical names. Removing one name does not remove the payload.
  • Examples are noxleyss and @noxleyss/baileys, @nyzzpedia/baileys-new and @nyzzpediaa/baileys-new, and @ikyyjee/ikyysingle and @ikyyjee/ikyysinggle.
  • A GitHub account links two packages that share no name.
  • The package lilys-baileys declares github.com/FallEzz/baileys-corp as its repository.
  • The same account hosts news.json, the channel list that cantarella-baileys fetches at runtime.
  • Both channels that lilys-baileys follows are on that list.


Affected Packages

PackagePublished (UTC)FamilyStatusDownloads
ourin-baileys2026-04-11 11:08WhatsApp SubscriberLive130589
@nexustechpro/baileys2026-01-09 19:14WhatsApp SubscriberLive62155
@badzz88/baileys2026-01-07 07:49WhatsApp SubscriberLive52173
@ostyado/baileys2025-12-05 12:02WhatsApp SubscriberLive48942
levvleys2026-06-10 22:29WhatsApp SubscriberLive37007
@vanzxy/baileys2026-06-08 11:05WhatsApp SubscriberLive15533
@yudzxml/baileys2026-05-10 17:37WhatsApp SubscriberLive13716
@chatunity/baileys2025-12-03 16:22WhatsApp SubscriberLive11536
@kelvdra/baileys2025-12-27 07:14WhatsApp SubscriberLive8333
neuralwhatsapp2026-02-24 13:41WhatsApp SubscriberLive5475
lilys-baileys2025-12-03 10:40WhatsApp SubscriberLive6174
@fyxzpediaa/baileys2026-08-22 01:21WhatsApp SubscriberLive5615
noxleyss2026-08-14 10:46WhatsApp SubscriberLive4919
@xrelly-stack/bails2026-06-26 17:29WhatsApp SubscriberLive4717
alipclutch-baileys2025-10-20 04:57WhatsApp SubscriberLive4473
kurobails2026-05-23 14:02WhatsApp SubscriberLive4380
eliteprotech-baileys2026-02-05 12:12WhatsApp SubscriberLive4032
@xayz/baileys2026-08-16 07:15WhatsApp SubscriberLive3948
chromestaff-baileys2026-05-21 15:20WhatsApp SubscriberLive3239
@sanzoffc/baileys2026-03-12 22:42WhatsApp SubscriberLive3184
@sairidev/baileys-new2026-05-31 10:30WhatsApp SubscriberLive2827
cloud-baileys2026-08-11 11:02WhatsApp SubscriberLive2642
@nyzzpediaa/baileys-new2026-09-05 06:20WhatsApp SubscriberLive2599
ishumdz-bail2026-09-25 08:05WhatsApp SubscriberLive2502
nishiki-bail2026-08-18 09:37WhatsApp SubscriberLive2453
diezyclutch-baileys2026-08-06 20:36WhatsApp SubscriberLive2297
oktz-baileys2026-08-30 09:38WhatsApp SubscriberLive2269
my-auto-follow2026-03-28 15:12WhatsApp SubscriberLive2240
@kanaraa/baileys2026-08-13 05:50WhatsApp SubscriberLive1866
@fer2809fl/baileys2026-03-09 21:53WhatsApp SubscriberLive1829
jexkcode2026-09-13 15:57WhatsApp SubscriberLive1835
rafael-bails2026-07-16 05:58WhatsApp SubscriberLive1655
@ikanngeming/ikannbail2026-09-05 09:06WhatsApp SubscriberLive1548
zero-baileys2026-07-12 12:18WhatsApp SubscriberLive1495
@zeronexcode/baileys2026-09-19 21:42WhatsApp SubscriberLive1450
@sakataoffc/baileys2026-08-23 09:53WhatsApp SubscriberLive1374
@astracode/byles-new2026-09-12 13:43WhatsApp SubscriberLive1286
@saazkira/baileys2026-05-30 12:05WhatsApp SubscriberLive1181
@lekzo/baileys2026-09-15 07:24WhatsApp SubscriberLive1177
@revizahoshii/baileys2026-09-06 08:23WhatsApp SubscriberLive1162
my-baileys2026-09-08 22:04WhatsApp SubscriberLive1001
noverojava2026-09-03 15:43WhatsApp SubscriberLive889
sauruskyah-baileys2026-09-13 15:19WhatsApp SubscriberLive836
@modss/baileys2026-09-01 23:54WhatsApp SubscriberLive813
@fhkryxv/baileys2026-08-19 01:39WhatsApp SubscriberLive802
@japofc/baileys2026-09-11 07:47WhatsApp SubscriberLive796
@lendxntaa/baileys2026-09-25 16:50WhatsApp SubscriberLive725
baileys-xbats2026-09-19 11:30WhatsApp SubscriberLive679
kiyoramarkets2026-08-19 18:48WhatsApp SubscriberLive612
@levvicode/baileys2026-09-11 02:26WhatsApp SubscriberLive592
luoxy-baileys2026-09-13 02:29WhatsApp SubscriberLive545
@mikudeveloper/grace2026-09-19 04:09WhatsApp SubscriberLive535
cortana-md-engine2026-09-10 18:08WhatsApp SubscriberLive531
@bellaxchuu/flowblue2026-09-05 20:12WhatsApp SubscriberLive476
@wanzlonely/bails4u2026-08-07 14:57WhatsApp SubscriberLive460
mikuhostt-baileys2026-09-18 19:41WhatsApp SubscriberLive443
cantarella-baileys2026-09-21 07:23WhatsApp SubscriberLive436
saurustheking2026-09-19 05:16WhatsApp SubscriberLive419
@mivesensei/baileys2026-09-09 23:50WhatsApp SubscriberLive364
@revizahoshii/hoshino2026-09-21 03:52WhatsApp SubscriberLive354
@noxleyss/baileys2026-09-18 11:13WhatsApp SubscriberLive341
@fhkryxv/baileys-new2026-09-04 04:38WhatsApp SubscriberLive325
@fazzcodestudio/wa-web2026-09-10 23:09WhatsApp SubscriberLive308
@ikyyjee/ikyysingle2026-09-05 20:55WhatsApp SubscriberLive267
focashi2026-08-29 09:39WhatsApp SubscriberLive250
@zanta/baileys2026-09-17 17:41WhatsApp SubscriberLive247
shadowmd2026-08-27 10:10WhatsApp SubscriberLive245
@ikyyjee/ikyysinggle2026-09-05 20:47WhatsApp SubscriberLive237
itsmeeaizat-bailey2026-09-09 14:59WhatsApp SubscriberLive212
@bellaxchuu/privatebails2026-09-03 19:28WhatsApp SubscriberLive173
arsya-baileys2026-09-25 15:41WhatsApp SubscriberLive136
xzvexpzcbailey2026-09-15 00:28WhatsApp SubscriberLive59
@mr-supun-fernando/supunmd-bail2026-09-22 04:26WhatsApp SubscriberLive0
yonzofficial2026-09-22 12:12WhatsApp SubscriberLive0
fixo-baileys2026-09-22 19:18WhatsApp SubscriberLive0
@jojoxyz/condemnedforce-baileys2026-09-23 01:42WhatsApp SubscriberLive0
@rixxcodex/baileys2026-09-23 21:13WhatsApp SubscriberLive0
@lendkzn/xntaabail2026-09-24 01:42WhatsApp SubscriberLive0
spencer-baileys2026-09-24 06:21WhatsApp SubscriberLive0
@wenzyx1/bails2026-09-24 08:51WhatsApp SubscriberLive0
yonzoffic-baileys2026-09-26 06:59WhatsApp SubscriberLive0
@xatancchii/velycxbail2026-09-27 00:45WhatsApp SubscriberLive0
@kxa/xbails2026-09-27 09:40WhatsApp SubscriberLive0
monte-md-baileys2026-09-27 12:43WhatsApp SubscriberLive0
albert-anitabaileys2026-09-27 13:07WhatsApp SubscriberLive0
@web2apk/baileys2026-09-08 06:29WhatsApp SubscriberTaken down2988
dilxztech2026-09-14 14:03WhatsApp SubscriberTaken down2068
kiki-baileys2026-09-07 14:31WhatsApp SubscriberTaken down886
anuaja2026-08-26 02:30WhatsApp SubscriberTaken down741
@bellaxchuu/xtrxbails2026-08-31 17:16WhatsApp SubscriberTaken down202
noverojs2026-09-05 01:46WhatsApp SubscriberTaken down131
sea-baileys2026-09-20 16:41WhatsApp SubscriberTaken down130
focaleys2026-08-29 09:33WhatsApp SubscriberTaken down82
@bottino/baileys2026-08-14 14:17WhatsApp SubscriberTaken down26
saturn-baileys2026-08-16 05:11WhatsApp SubscriberTaken down0
@bellaxchuu/belbails2026-09-01 19:04WhatsApp SubscriberTaken down0
@bellaxchuu/teambails2026-09-03 18:15WhatsApp SubscriberTaken down0
@nyzzpedia/baileys-new2026-09-05 04:24WhatsApp SubscriberTaken down0
noxxleys2026-08-13 11:09WhatsApp SubscriberTaken down0
saturn-bail2026-08-24 12:35WhatsApp SubscriberTaken down0
kasabaileys2026-09-27 16:32WhatsApp SubscriberTaken down0

IOCs

Remote channel lists. The operator edits these files to retarget every installed copy without publishing a new npm version. All were live on 2026-09-24.


Conclusions

While this malicious campaign isn’t directly aimed at stealing data or crypto currency, it exposes unaware victims to scam and illegal trade. Since the threat actors are muting these channels on the victim’s devices, it serves as social proof for those channels – by having an inflated follower count.

This campaign shows another way threat actors abuse the npm registry, our previous report on ClickFix Phishing Pages Discovered in 24 npm Packages showed how threat actors use the platform to spread HTML pages with malicious redirects, which can be rendered on mirror websites such as unpkg.com, now we see another point of view where the platform is used to spread illegal selling content and WhatsApp groups member count inflation.

Due to classic malicious code signatures being absent from this campaign, such as stealing API tokens and heavy obfuscation, these scam campaigns could easily slip under the radar in threat detection tools and inside large organizations, making them less prone to removal and leaving them online for much longer than the average malware.

References

  • SafeDep, “Baileys npm forks farm WhatsApp Channel followers” (2026-08-10), earlier reporting on the same campaign
  • Xygeni, “Malicious npm Package in Baileys Fork (Skyzopedia Case)” (2026-09-18), analysis of @dappaoffc/baileys-mod.
  • OSV malicious-package entries for packages in this report: MAL-2026-12108 (alipclutch-baileys), MAL-2026-13482 (diezyclutch-baileys), MAL-2026-13932 (my-auto-follow), MAL-2026-15918 (@modss/baileys), MAL-2026-16070 (@fyxzpediaa/baileys), MAL-2026-16104 (@nexustechpro/baileys), MAL-2026-16220 (jexkcode), MAL-2026-16276 (@lekzo/baileys), MAL-2026-16280 (zero-baileys), MAL-2026-16281 (@sanzoffc/baileys), MAL-2026-16387 (@mr-supun-fernando/supunmd-bail), MAL-2026-16389 (noverojava), MAL-2026-16473 (sea-baileys), MAL-2026-16483 (@rixxcodex/baileys).

Upstream library these packages fork, @whiskeysockets/baileys

How OX Can Help

Malicious dependency vetting

All of the above packages and future variants of this malicious campaign are included in the OX security malware database. 

OX customers using VibeSec trying to install one of the malicious packages  will be blocked by the platform and an alternative safe package will be suggested to them. 

OX customers pushing code with the malicious package as dependency will also be blocked by the OX platform pipeline scan. 

Not using VibeSec yet? Take the VibeSec product tour
OX cloud 1

Active AI Defense. Complete Cloud Visibility.

Your agents hold identities you never issued. See what they touch, in real time.

Meet OX Cloud

Related News