The lotusbail NPM package steals WhatsApp credentials, messages, and contacts, and provides persistent access to the victims’ accounts.
A “Featured” browser add-on marketed as privacy protection may have been copying AI chats. Koi Security says Urban VPN Proxy began intercepting prompts and replies after a July 9, 2025 update.