Skip to content
NewA calmer, faster ZeroHour
Phishing & fraudmediumExploited in the wild

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

The Hacker Newsby @TheHackersNews ()2 min read2 · 1 read
Read at thehackernews.com
AI summary · glm-5.3-flashSummaries by Vani AI

OX Security researchers found 24 npm packages abusing unpkg mirrors to host fake Cloudflare CAPTCHA pages that redirect victims to attacker-controlled phishing infrastructure.

OX Security researchers documented 24 npm packages whose single HTML pages, once mirrored on services like unpkg.com, render as fake Cloudflare CAPTCHA pages on trusted domains and redirect victims to attacker-controlled phishing infrastructure for ClickFix attacks or credential harvesting. An earlier version contacted a typosquat Microsoft login domain (login.microsofte.live); after Chrome Safe Browsing blocklisting, the actor switched to the KeyVal key-value store as a dead drop resolver, currently redirecting to the legitimate ChatGPT site. The approach mirrors Socket's October 2025 report on 175 npm packages abusing unpkg.com in the Beamglea campaign.

Key facts
  • npm registry mirrors like unpkg serve attacker HTML as trusted-domain fake CAPTCHA pages redirecting to phishing infrastructure.
  • Packages contain a single harmless HTML page; abuse targets mirrors as free, persistent hosting rather than developer infection.
  • Actor shifted C2 from typosquat login.microsofte.live (Chrome-blocklisted) to KeyVal key-value store as dead drop resolver.
  • Redirects currently point to the legitimate ChatGPT site but can be switched to ClickFix or credential-harvesting domains.
  • Technique echoes October 2025 Beamglea campaign of 175 npm packages abusing unpkg.com.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1566.002 Spearphishing LinkT1204.004 Malicious Copy and Paste
Tags
clickfixcloudflarecredential-harvestingnpmphishingsupply-chainunpkg
Vendors
OX SecuritySocket
Products
npmunpkgCloudflare CAPTCHAClickFixKeyVal

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Aug 25, 2026 Phishing / Threat Intelligence Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.