Full Report
Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor’s use of npm isn't to infect developers who install it, but to use the
Analysis Summary
# Tool/Technique: npm Infrastructure Abuse for ClickFix Phishing
## Overview
This technique involves the strategic abuse of the npm registry and its associated Content Delivery Network (CDN) mirrors (such as `unpkg`) to host malicious phishing infrastructure. Rather than targeting developers via malicious code execution, the threat actor uses these platforms as a "free" and "trusted" hosting service for HTML-based phishing pages. These pages typically mimic legitimate services like Cloudflare CAPTCHA to trick users into executing actions that lead to malware delivery (ClickFix).
## Technical Details
- **Type:** Technique / Infrastructure Abuse
- **Platform:** Web Browsers / Cross-platform
- **Capabilities:** Phishing hosting, Dead Drop Resolving (DDR), Redirection, Evasion of URL blockers.
- **First Seen:** Reported August 2026 (referencing similar campaigns dating back to October 2025).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]**
- **[TA0011 - Command and Control]**
- **[T1102.001 - Web Service: Dead Drop Resolver]**
- **[TA0005 - Defense Evasion]**
- **[T1553 - Subvert Trust Controls]** (Using trusted CDN domains to host malicious content)
## Functionality
### Core Capabilities
- **Trusted Hosting:** By uploading an npm package containing a single HTML file, the actor leverages mirrors like `unpkg[.]com` to host live, fully rendered web pages. Because these domains are legitimate and widely used, they often bypass basic reputation-based web filters.
- **Fake CAPTCHA (ClickFix):** The hosted HTML mimics a Cloudflare "Verify you are human" page to establish a false sense of security.
- **Dynamic Redirection:** The JavaScript within the HTML page redirects the victim to a final phishing or malware-delivery destination.
### Advanced Features
- **Dead Drop Resolving (DDR):** The campaign utilizes `api.keyval[.]org`, a public key-value store, to dynamically retrieve the final redirect URL. This allows the attacker to change the destination URL in real-time without updating the npm package.
- **Evasion:** By moving logic to a DDR (KeyVal), the threat actor can bypass static blocklists (like Google Safe Browsing) that targeted their previous typosquatted domains.
## Indicators of Compromise
### File Names (npm Packages)
* bgzxcuite2
* prezdentkxheiw
* egair0810
* mnteckets
* airdzticket
* egypt0811
* passport811
* vxhjkseuiaqkb
* ndmushdkeqe
* ndmxchdjxn2
* ndmfguyhoxc3
* mjsdqwocvn
* m2fcsfyjkuxb
* m3fdfocdoewn
* @worrisome/reutil
* testdgdbcsd
* tesgfvbncsdbcv
* mndsxcusiwlk1
* mn2adskhweox
* mn3sadkoiewu
* mn4xcouzvhus
* mbxcnsuwgs1
* skxcmwuncbg2
* mobiwaefhxc3
### Network Indicators
* **Hosting Mirrors:** `unpkg[.]com`
* **DDR Service:** `api.keyval[.]org`
* **Typosquat Domain:** `login[.]microsofte[.]live`
* **Final Redirect (Observed):** `chatgpt[.]com` (Current decoy, likely used for testing or redirection to ClickFix variants).
## Associated Threat Actors
- **Campaign Name:** Beamglea (Related/Similar activity reported by Socket).
- **Specific Cluster:** A group targeting npm mirrors for ClickFix-style social engineering.
## Detection Methods
- **Behavioral Detection:** Monitoring for browser network requests to public key-value APIs (like KeyVal) followed by immediate redirects to suspicious domains.
- **Content Inspection:** Scanning npm registry uploads for standalone HTML files that contain "Verify you are human" strings or Cloudflare-mimicking CSS/JS code.
- **URL Analysis:** Identifying URLs that point to npm CDN mirrors but serve `text/html` content instead of expected `application/javascript`.
## Mitigation Strategies
- **Web Filtering:** Implement granular controls on developer-focused CDNs (unpkg, jsDelivr) to block access to HTML files unless specifically required for business needs.
- **User Education:** Train users to recognize that CAPTCHA pages hosted on third-party domains (like npm mirrors) are illegitimate.
- **Registry Monitoring:** Organizations should monitor their internal npm usage and audit packages that consist solely of non-code assets like HTML and CSS.
## Related Tools/Techniques
- **ClickFix:** A social engineering tactic where users are prompted to copy-paste malicious commands into their terminal under the guise of "fixing" a browser error.
- **Typosquatting:** Previously used by this actor to impersonate Microsoft login pages.
- **Living off the Land (LotL):** Using legitimate services (npm, KeyVal) to conduct malicious activity.