Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
24 Malicious npm Packages Abuse Mirror Infrastructure to Host Obfuscated ClickFix Phishing Pages
Excerpt
Cybersecurity researchers have uncovered 24 malicious npm packages that abuse package mirror services to host obfuscated phishing pages. The packages do not infect a device when a developer downloads or installs them. Instead, the campaign turns trusted npm-related infrastructure into a platform for social engineering. OX Research said each package carried the same HTML file and commonly gained 50 to 300 weekly downloads before removal. The threat actor relies on npm’s…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | login.microsofte.live | High | Score 72/100 | First seen |
IOC Relationship Graph
Building graph…