Full Report
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. [...]
Analysis Summary
# Tool/Technique: NPM Mirror Phishing Redirection
## Overview
This technique involves threat actors abusing the **npm registry** and its legitimate mirroring services (such as **UNPKG** and **npmmirror**) to host malicious HTML files. Instead of a traditional supply-chain attack aimed at infecting developers, the attackers use these platforms as free, high-reputation web hosting. The hosted pages typically impersonate Cloudflare CAPTCHA verifications to lend an air of legitimacy before redirecting victims to phishing sites or attacker-controlled infrastructure.
## Technical Details
- **Type:** Technique (Reputation Hijacking / Living-off-the-Land)
- **Platform:** Web Browsers (Cross-platform)
- **Capabilities:** Hosting phishing content, bypassing domain-based reputation filters, obfuscated redirection, remote configuration of destination URLs.
- **First Seen:** July 2024 (via 'china_airlines' npm package)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0005 - Defense Evasion]**
- [T1564 - Hide Artifacts] (Using legitimate mirrors to mask malicious code)
- [T1213.003 - Content Stored in Code Repositories]
- **[TA0007 - Discovery]**
- [T1012 - Query Registry] (Abusing api.keyval.org for dynamic configuration)
## Functionality
### Core Capabilities
- **Reputation Hijacking:** By hosting HTML files on `unpkg[.]com` or `npmmirror[.]com`, attackers bypass security products that whitelist these trusted developer domains.
- **CAPTCHA Impersonation:** The HTML pages embed legitimate Cloudflare Turnstile CAPTCHA services to deceive users into believing the site is secure.
- **Obfuscated Redirection:** Uses heavily obfuscated JavaScript to move the user from the legitimate mirror domain to a malicious landing page.
### Advanced Features
- **Dynamic C2 Redirection:** Newer variants utilize the `api.keyval[.]org` (a key-value storage service) to retrieve encrypted redirect URLs. This allows attackers to change the final phishing destination in real-time without updating the npm package.
- **Persistence via Mirrors:** Malicious packages often persist on third-party mirrors even after they have been reported and removed from the primary npm registry.
## Indicators of Compromise
- **File Names:** `index.html`, `package.json`
- **Network Indicators:**
- `unpkg[.]com/[package_name]@version/index.html`
- `npmmirror[.]com` (various mirrors)
- `microcloud[.]homes` (Phishing Landing)
- `login[.]microsofte[.]live` (Phishing Landing - defanged)
- `api[.]keyval[.]org` (External configuration source)
- **Behavioral Indicators:**
- Direct browser navigation to an HTML file hosted on a CDN-like npm mirror.
- Automated redirection immediately following a CAPTCHA completion on a non-corporate domain.
## Associated Threat Actors
- Unknown (Technique has been linked to broader "ClickFix" style phishing campaigns, but specific group attribution is not confirmed in the source).
## Detection Methods
- **Behavioral Detection:** Monitor for HTTP referer headers originating from `unpkg.com` or `npmmirror.com` leading to known phishing TLDs (e.g., .live, .homes).
- **URL Inspection:** Identify direct HTML requests to npm mirror domains that are not part of a standard application build process.
- **Traffic Analysis:** Alert on connections to `api.keyval.org` initiated by a browser session while on an npm mirror domain.
## Mitigation Strategies
- **Web Filtering:** Implement strict URL filtering that inspects the full path of high-reputation domains, rather than just the root domain.
- **Email Security:** Screen incoming links for patterns involving npm mirror paths followed by `.html`.
- **User Awareness:** Train employees to recognize that a CAPTCHA on a domain like `unpkg.com` is highly unusual and indicative of a redirector.
## Related Tools/Techniques
- **ClickFix Phishing:** A similar social engineering tactic where users are prompted to "fix" a browser/security error by running a script.
- **Typosquatting:** Often used in conjunction with this technique to name packages after legitimate organizations (e.g., `china_airlines`).
- **Living-off-Trusted-Sites (LOTS):** The broader strategy of using legitimate services (GitHub, Google Drive, npm) to host malware.