24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
Summary: OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko disclosed a campaign using a cluster of 24 npm packages, some still available for download, as free phishing infrastructure that serves fake Cloudflare CAPTCHA pages from mirrors like unpkg. The HTML page, hosted on a trusted domain, redirects victims to attacker-controlled sites; after a typosquatted Microsoft login domain was added to Chrome's Safe Browsing blocklist, the actor switched to the KeyVal key-value store as a dead drop resolver, and the remote logic currently sends users to the legitimate ChatGPT website.
Key Takeaway: The payload lives in npm mirrors that can persist even after packages are removed from the official registry, so takedown of the source does not remove the hosted page. The actor also adapted within the campaign, replacing a blocklisted domain with a legitimate public key-value service, which means blocking individual domains will not close this delivery path.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026