Aku; DR
He mea hoʻopuka npm hoʻokahi, deadcode09284814, ua holo i kahi hoʻolaha typosquat e kūʻē i ke kūpono axios a chalk-template nā pūʻolo mai waena o Mei 2026.
Ua hoʻomaka ka hoʻolaha ma ke ʻano he mea ʻaihue palapala hōʻoia maʻamau a me ka ʻeke kālā, e hoʻokaʻawale ana i ka ʻikepili i kahi ʻO ke ana o Serveo HTTPS.
On 2026-05-17, a me axois-utils:1.0.9, ua hoʻololi holoʻokoʻa ka mea hoʻohana i ka ukana: ʻo ka scaffold install-hook ʻekolu like, ka mea hoʻopuka like, ka inoa pūʻolo like.
Akā, ʻo ka palapala hoʻonohonoho i kēia manawa he cross-platform DDoS botnet recruit.
ʻŌlelo ka ukana i kahi localhost.run tunnel a ʻae i nā kauoha kahe, e hoʻohuli ana i nā wahi i loaʻa i ka maʻi i ʻāpana o kahi botnet hiki ke DDoS.
Ua hoʻouna aku nō hoʻi ka mea hoʻokele i ka ʻO ka binary kikowaena C2 i loko o ka tarball, e hōʻike ana i kahi piʻi maopopo mai ka ʻaihue hōʻoia i ka ʻoihana botnet hana.
ʻElua mau pūʻolo, ʻehā mau mana e hana mau nei ma ke kāinoa, a hoʻokahi mea hoʻohana e holo nei i nā modula ʻelua ma ka ʻaoʻao like.
ʻO ke koʻikoʻi: kiʻekiʻe.
Ka Hoʻouka: Pehea e Hana ai
Ua kūkulu ʻia ka hoʻolaha ma luna o kahi ʻano hoʻouna hoʻoluhi: ʻelua mau inoa pūʻolo typosquat, hoʻokahi leka mai nā pūʻolo me nā haneli miliona o nā hoʻoiho hebedoma (axios, kumu hoʻohālike palapala), a me ka hoʻouka ʻekolu hooks e hōʻoiaʻiʻo ana i ka hoʻokō ʻana. ʻO ka mea hoihoi, ʻo ia ke ʻano o ka scaffold halihali — a me ka ʻoiaʻiʻo ua hoʻololi ka mea hoʻokele i ka ukana me ka hoʻololi ʻole i kekahi mea ʻē aʻe.
ʻO ke kahua i kaʻana like ʻia
Hōʻike kēlā me kēia mana i paʻi ʻia o nā pūʻolo ʻelua i ke ola like ʻekolu hooks in pakete.json:
"scripts": { "preinstall": "node <payload>.js", "install": "node <payload>.js", "postinstall": "node <payload>.js" } Ke papa inoa ʻana i ka ukana ma lalo o nā mea ʻekolu hooks he hana nui loa ia — ma hope o ke kau ʻana e holo wale nō ma kahi paʻamau npm hoʻokomoHe mea nui ke koho: npm install –ignore-scripts hōʻalo i nā palapala, akā he nui nā kahe hana maʻamau (hoʻihoʻi ka CI cache i kēlā pōʻaiapuni holo hou hooks koho wale nō, a i ʻole nā mea hoʻomohala nāna e loiloi wale ma hope o ke kau ʻana) e hana i kahi ʻōlelo hoʻolaha triple-redundant ʻo ia ka pili palekana loa no ka mea hoʻouka.
chalk-tempalte hoʻohui i kahi ʻano hana ʻelua: haʻi ia ʻaxois-utils:^1.0.7 ma ke ʻano he manawa holo hilinaʻiKe hoʻouka nei i ka typosquatted kumu hoʻohālike palapala no laila huki pū i ka typosquat kaikaina, a holo nā ukana ʻelua. He pālua i hoʻonohonoho ʻia nā pūʻolo ʻelua, ʻaʻole nā papa inoa kūʻokoʻa.
Māhele A — mea ʻaihue palapala hōʻoia / ʻeke kālā (2026-05-15 → i kēia manawa)
ʻO ka Māhele A ka ukana mua. He pōkole ka mea hoʻouka postinstall.js e kuhikuhi ana i kahi Serveo HTTPS reverse-tunnel:
// chalk-tempalte/postinstall.js:11-13 const C2_HOST = "f04a273bd84c0622-80-200-28-28.serveousercontent.com"; const C2_PORT = 443; const C2_PATH = '/collect'; Hoʻopili ka subdomain Serveo i ka IP destination (80.200.28.28) pololei ma ka inoa kikowaena - kahi kuʻuna i ʻike ʻia no kēlā lawelawe. Hoʻohuli ka mea hoʻohana i ka prefix subdomain maʻamau ma waena o nā mana e pale aku i nā papa inoa poloka kikowaena naïve, akā ʻaʻole neʻe ka IP ma lalo.chalk-tempalte:1.0.14 hoʻohana 8a3e818ea8f11186-80-200-28-28…; 1.0.16 / 1.0.19 / 1.0.20 hoʻohana f04a273bd84c0622-….)
postinstall.js lima ʻole i phantom.js, he module "mea hōʻiliʻili" i hoʻopili ʻia me 7,667 laina. phantom.js hele ka mea hoʻokipa no:
Nā kī pilikino SSH (~/.ssh/*) |
.npmrc nā mea i loko a me kekahi npm_* nā hōʻailona env |
| Nā faila hōʻoia AWS, GCP, a me Azure |
ʻO ka regex hōʻailona-komo-pilikino GitHub (ghp_*, gho_*, ghu_*, ghs_*) |
| Nā mea hana kālā Crypto-wallet no Bitcoin, Exodus, Electrum, Monero, Litecoin, Dogecoin, Zcash, Dash |
He hana hou .env* hele i loko ~/projects, ~/dev, ~/code, ~/workspace, a me ka hoʻouka ʻana i ka cwd |
Nā mōʻaukala Shell a me ka piha process.env |
Ua hoʻouna ʻia ka pūʻolo i ke ana ʻo Serveo ma /hōʻiliʻiliʻAʻohe obfuscation, ʻaʻohe logic anti-VM, ʻaʻohe staging - ʻo ka pili a ka mea hoʻohana ma ka leo a me ka wikiwiki.
Māhele B — Hoʻolimalima ʻo PhantomBot DDoS (2026-05-17, axois-utils:1.0.9 wale nō)
Hoʻololi ʻo Phase B iā phantom.js + postinstall.js me kahi faila hoʻokahi i kapa ʻia ʻo distrube.js (na ka mea hoʻohana ka typo). ʻAʻole i hoʻololi ʻia ka scaffold triple-hook ma package.json; mālama ka pūʻolo i ka inoa like, ka laulā, a me ke ʻano version-bump. Mai waho mai, ua like ʻo axois-utils:1.0.9 me kahi hahai liʻiliʻi i 1.0.6. I loko, he ʻohana malware ʻokoʻa ia.
distrube.js wehe ʻia me kahi poloka hoʻonohonoho e kapa ana i ka hōʻailona ponoʻī o ka mea hoʻohana:
// axois-utils-1.0.9/distrube.js:11-15 |
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally) |
const C2_HOST = 'b94b6bcfa27554.lhr.life'; // Your localhost.run tunnel |
const C2_PORT = 443; // HTTPS port - tunnel handles SSL |
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`; |
Hoʻouna ʻia nā manaʻo i kahi mea hoʻohana e holo ana i ka pahu hana ("E hoʻohana i kāu localhost.run HTTPS URL"). ʻO ia, me nā mea e hoʻouna ʻia ma ka ʻaoʻao o ka mea kūʻai aku bot, ʻo ia ka hōʻike ʻaʻole kēia he ukana i hōʻeha ʻia - ʻo ia ka pahu hana.
Ke kahe ʻana:
- Ka hoʻomau holo mua. Hoʻokomo ka script iā ia iho ma ʻekolu mau ʻano like ʻole no kēlā me kēia OS (registry holo + Waihona hoʻomaka + schtasks ma Windows; crontab + lawelawe phantom-bot ʻāpana ʻōnaehana + .bashrc/.zshrc hoʻohui + /etc/rc.local ma Linux; LaunchAgent com.phantom.bot.plist ma macOS). ʻO ka inoa lawelawe hoʻomau a me ka lepili LaunchAgent nā mea ʻelua phantom-bot / com.phantom.bot, ʻo ia hoʻi kahi i loaʻa mai ai ka inoa o ka hoʻolaha.
- ʻIke ʻōnaehana exfil holo hoʻokahi - he hoʻokahi pana manamana lima POST i b94b6bcfa27554.lhr.life:443/collect e lawe ana i ka inoa kikowaena, kahua, arch, inoa mea hoʻohana, CPU/RAM, nā pilina pūnaewele, process.env, cwd, homedir, mana node, a me ka IP lehulehu. ʻOi aku ka liʻiliʻi o ka hoʻouka kaua ʻana ma mua o ka Phase A: ʻaʻohe SSH, ʻaʻohe wallets, ʻaʻohe .env recursion. ʻO ka hana a ka bot ke kākau inoa, ʻaʻole e ʻaihue.
- Ka pōʻai puʻuwai wehe i kahi HTTPS POST i kēlā me kēia 30 kekona i b94b6bcfa27554.lhr.life:443/. ʻO ka User-Agent ʻo PhantomBot/1.0. Ua hoʻopau maopopo ʻia ka hōʻoia TLS (rejectUnauthorized: false). Ua wehewehe ʻia ka pane C2 ma ke ʻano he JSON o ke ʻano {type, target, port, duration, threads, method} a hoʻouna ʻia.
- Nā mea kaua waikahe ua hoʻopili ʻia i ʻeono mau kauoha:
| ʻAno kauoha | Kōwae | Notes |
|---|---|---|
| ping | Pane ola | Hōʻike ʻo Bot iā ia iho |
| http | Kahekahe HTTP | Ke kahe ʻana o ke noi ʻana o ka Papa-7 |
| https | Kahekahe HTTPS | E like me http, ua kāʻei ʻia me TLS |
| tcp | Kahekahe TCP | 65 KB spam uku-kaulele |
| pud | Ka waikahe UDP | Nā pākēkē UDP 65,507-byte |
| wikiwiki | HTTP/2 hoʻonohonoho wikiwiki DoS | ʻO ke ʻano hana 2023 CVE-2023-44487 |
Lawe nā modula kahe ʻelima a pau i kahi polokalamu, ke awa, lōʻihi, a pae paha hoʻopaʻapaʻa - he mea hoʻokahe wai hoʻolimalima maʻamau ka bot, ʻaʻole i kuhikuhi ʻia i kekahi mea i hōʻeha ʻia. Noho ka papa inoa mea i hōʻeha ʻia e ka mea hana ma ka C2, ʻaʻole i loko o ka pūʻolo.
He aha ka mea hou ma aneʻi - ka binary C2 i hoʻouna ʻia
He ʻano kamaʻāina ka Māhele A: ʻaihue palapala hōʻoia, hoʻokomo i ka makau, C2 i hoʻokomo ʻia i loko o ka mea kūʻai aku. ʻO ka Māhele B no hoi he ʻano kamaʻāina - ua lilo nā botnets DDoS i mea paʻa o nā pūʻolo npm ʻino no nā makahiki. ʻO ka mea kupanaha, ua hoʻouna ka mea hoʻokele i ka ʻaoʻao kikowaena o ka pahu i loko o ka npm tarball:
- c2 — he 4-megabyte i hōʻuluʻulu ʻia ʻo Go ELF binary
- c2.go — ke kumu Go laina 426 no kēlā binary
ʻAʻole i kāhea ʻia kekahi o nā faila e kekahi makau hoʻonohonoho. ʻAʻole lākou he ʻāpana o ka ukana i hōʻeha ʻia. Ke noho nei lākou i loko o ka papa kuhikuhi pūʻolo e like me ka hana a kahi faila palapala. ʻO ka heluhelu kūpono loa, ua hoʻokuke ka mea hana i kā lākou lāʻau hana hoʻomohala i npm me ka ʻole o ka mālama ʻana i ka papa inoa faila - kahi slip OpSec maoli - a ʻo ka mea i hoʻouna ʻia ʻo ia ka pahu ʻelua ʻaoʻao piha: ka mea kūʻai aku a ka mea i hōʻeha ʻia e holo ai, a me ke kikowaena a ka mea hana e holo ai.
ʻO kēia ka ʻāpana o ka moʻolelo e hoʻāpono ana i ka hoʻokumu ʻana o ka "turnkey botnet kit". ʻO kēlā me kēia mea nāna i hoʻoiho axois-utils:1.0.9 ma mua o ka takedown ʻaʻole wale kahi laʻana o ka mea i hōʻeha ʻia - loaʻa iā lākou kahi kikowaena C2 e hana ana.
ʻO ka pivot, ma hoʻokahi ʻōlelo
Hoʻopuka like, inoa pūʻolo like, scaffold triple-hook like, hōʻailona "phantom" like - akā ua hoʻololi ka ukana i ke kumu hoʻohālike monetization i ka pō hoʻokahimai nā "mea huna ʻohi hiki iaʻu ke kūʻai hou aku" a i ka "hoʻolimalima waikahe hiki iaʻu ke hoʻolimalima". ʻO nā TTP manawa hoʻonohonoho e pono ai nā mea pale e nānā pono ua aneane like ma nā pae ʻelua; nā pale e pili ana i ke kau inoa i hoʻopaʻa ʻia i nā kaula ala ʻeke o ka Phase A a i ʻole phantom.jsʻO ka mea hōʻiliʻili laina 7,667 o ia mea, inā ua hala loa ʻo ia i ka Phase B.
| Lā (UTC) | hanana |
|---|---|
| 2026-05-15 | Ka paʻi mua ʻana: axois-utils:1.0.4 (Kūkulu hoʻāʻo LAN, hoʻolālā hoʻomohala ma 192.168.129.19) |
| 2026-05-15 | axois-utils:1.0.6 i paʻi ʻia — ua hoʻololi ʻia ka Māhele A C2 i 80.200.28.28 ma o ke alahaka ʻo Serveo; ka manaʻo kumu // Change to '80.200.28.28' for public hōʻoia i ka dev→prod swap |
| 2026-05-16 | chalk-tempalte:1.0.14 a 1.0.16 paʻi ʻia — ke hoʻolaha nei ka mea hoʻouka kaulahao axois-utils:^1.0.7 ma ke ʻano he hilinaʻi runtime; Ua hoʻohuli ʻia ke kikowaena inoa Serveo |
| 2026-05-16 | Ua ʻike ʻia ka hoʻolaha Pae A i ka wā o ka nānā ʻana i ka npm maʻamau; ua hoʻopili ʻia nā ʻōlelo hoʻoholo i hōʻoia ʻia he ʻino |
| 2026-05-17 | axois-utils:1.0.9 paʻi ʻia — pivot payload: PhantomBot DDoS recruit ma o ka localhost.run tunnel; ʻaoʻao o ka mea hana c2 pālua a me c2.go kumu i hoʻouna ʻia i loko o ka tarball |
| 2026-05-17 | chalk-tempalte:1.0.19 a 1.0.20 paʻi ʻia - ʻo ia nō ka Phase A (stealer); ke holo nei ka mea hoʻohana i nā modula ʻelua ma ke ʻano like |
| 2026-05-17 | Ka ʻike ʻia ʻana o ka Māhele B i ka wā o ka nānā ʻana maʻamau; ua hoʻopili ʻia nā hopena ma nā mea āpau 2026-05-17 wale nō |
| (ke hoʻomau nei) | Ke kali nei nā hōʻike lawe ʻana; loaʻa nā pūʻolo ʻehā i paʻi ʻia ma ka papa inoa i ka wā kākau |
Nā Hōʻailona o ke Kuʻikahi
pūʻolo helu
| Ke kaiaola | pūʻolo | wale nō |
|---|---|---|
| npm | axois-utils (typosquat o axios) | 1.0.4, 1.0.6, 1.0.9 |
| npm | chalk-tempalte (typosquat o ka chalk-template) | 1.0.14, 1.0.16, 1.0.19, 1.0.20 |
Ka ʻike o ka mea kākau
| Field | Value |
|---|---|
| mea hoʻopuka npm | deadcode09284814 |
| Leka uila a ka mea hoʻopuka | phantomdeadcode@tutamail.com |
| SCM hōʻoia | kekahi |
Kauoha-a-mana
| Māhele | Hopena | amo |
|---|---|---|
| A | f04a273bd84c0622-80-200-28-28.serveousercontent.com:443/collect | ʻO ke ana o Serveo HTTPS |
| A | 8a3e818ea8f11186-80-200-28-28.serveousercontent.com:443/collect | ʻO ke ana o Serveo HTTPS (mana mua) |
| A | 80.200.28.28:443/collect | Ka hopena VPS ma lalo |
| B | b94b6bcfa27554.lhr.life:443/ | localhost.run HTTPS reverse-tunnel |
Nā hōʻuluʻulu waihona (SHA-256)
| File | SHA-256 | Notes |
|---|---|---|
c2 (E hele ELF, 4 MB) | 165fa92d237fd017c227d00da06ab788212a62be94bf61e95df2d22d00377ef2 | Kikowaena C2 ʻaoʻao o ka mea hana, i hoʻouna ʻia i loko axois-utils:1.0.9 |
c2.go (426 laina) | 7d0ae79fdb1e9968f3323a3712b624643a782ba3efb2cf3a2cb9c4c5513cea30 | E hele i ke kumu no ka binary C2 |
distrube.js | 308b15c023088a7188dea4ef609010ac2493eb4c365b103053d7621a9ca5b935 | Mea kūʻai aku bot Phase B |
phantom.js (chalk-tempalte:1.0.19) | 9e380ec88d3ccf3929e1a104e3b868d4d7b59ca189a8a431a54e9f3357dfdd81 | ʻO ka mea hōʻiliʻili palapala hōʻoia / ʻeke kālā Pae A |
phantom.js (chalk-tempalte:1.0.20) | d1c9e3f296ee9f7d5032f73f9c504cede50334bc14c394055fd5cb9c3a6e08b3 | ʻO ka mea hōʻiliʻili Pae A (ʻano like ʻole 1.0.20) |
postinstall.js (chalk-tempalte:1.0.19 = 1.0.20) | ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162 | Mea hoʻouka Pae A, byte-like ma nā mana ʻelua |
Ka Hoʻoili a me ka Hoʻoikaika
Ke hahai nei mākou i kēia hoʻolaha e like me PhantomBot, e lawe ana i ka hōʻailona ponoʻī o ka mea hana mai ka Luna Hoʻohana: PhantomBot/1.0 poʻomanaʻo o ka puʻuwai, ka lawelawe phantom-bot ʻāpana ʻōnaehana, ka com.phantom.bot lepili LaunchAgent, a me ka phantomdeadcode@ leka uila. Kūpaʻa ka mea hoʻohana e pili ana i kēia inoa ma ka liʻiliʻi he ʻehā mau mea hana.
Papa inoa hōʻailona
- Ka mea hoʻopuka - deadcode09284814 ma ka npm. Moʻokāki hoʻokahi lima, leka uila hoʻolei ʻo Tutamail, ʻaʻole SCM hōʻoia. ʻAʻohe mōʻaukala paʻi mua ma mua o kēia hoʻolaha.
- Hoʻohana hou ʻana i ka hōʻailona — ʻike ʻia ʻo “phantom” ma ka leka uila a ka mea hoʻopuka, ma ka inoa faila Phase A collector (phantom.js), ma ka inoa lawelawe hoʻomau o ka Pae B (lawelawe phantom-bot), ma ka lepili LaunchAgent (com.phantom.bot), a ma ka bot User-Agent (PhantomBot/1.0).
- aeuiiai ieaia? — Hoʻokahi VPS ma 80.200.28.28 nā mua o ka Māhele A ma o ka hoʻololi ʻana o ka subdomain Serveo; neʻe ka Māhele B i kahi localhost.run ke ana hope (b94b6bcfa27554.lhr.ola). Manuahi nā lawelawe a nā mea kūʻai aku ʻelua a koi wale i ka SSH outbound ma ka ʻaoʻao o ka mea hoʻohana, e kūlike me nā hoʻonohonoho haʻahaʻa kālā, haʻahaʻa-OpSec.
- Kāhua code — JavaScript maʻemaʻe ma nā wahi a pau; ʻaʻohe obfuscation, ʻaʻohe encoding string, ʻaʻohe nānā anti-VM. He wehewehe nā inoa loli (ʻaihueʻIkePūnaewele, hoʻokō Kauoha, httpKahanuiNā manaʻo ma loko distrube.js e hoʻouna pololei aku i kahi mea hoʻohana e hiki mai ana ("E hoʻohana i kāu localhost.run HTTPS URL"), e hōʻike ana ua manaʻo ʻia ka faila e hoʻolaha hou ʻia ma ke ʻano he pahu, ʻaʻole i hoʻohana ʻia e kahi mea hoʻouka hoʻokahi.
- Paheʻe OpSec — Hoʻouna ka tarball Phase B i ka mea kūʻai aku bot a me ke kikowaena C2 ʻaoʻao-mea hoʻohana (c2 ELF + c2.go kumu). He kūlike kēia me kahi mea hana nāna i hoʻokuke i kā lākou lāʻau hana i npm me ka nānā ʻole ʻana i ka papa inoa faila. ʻAʻole paha i ʻike ka mea hana, a i ʻole ʻo ka pahu hana keʻano e hoʻolaha ʻia i ka lehulehu a ʻo ka binary C2 kekahi ʻāpana o ka huahana.
- Hōʻoia ponoʻī - axois-utils:1.0.4 aia ka manaʻo kumu // E hoʻololi i '80.200.28.28' no ka lehulehu ma ka laina 12, e hōʻoia ana i ka holomua o ka dev / staging / production a nā mea hana e hōʻole pinepine ai.
Hoʻokumu
ʻO ka ukana Phase A he ʻaihue kālā pololei: nā palapala hōʻoia, nā kī ao, nā hōʻailona GitHub, a me nā ʻeke crypto a pau he mau mākeke kūʻai hou wai. He kālā nō hoʻi ka Phase B, akā ʻaʻole pololei: hoʻolimalima nā lawelawe DDoS-for-hire ("booter") i ka hiki ke kahe i kēlā me kēia minuke, a ʻo nā bots e like me ka mea i hoʻouna ʻia ma ʻaneʻi nā waihona e holo nei kēlā mau lawelawe. ʻO ka puʻuwai 30-kekona, ka generic polokalamu/ke awa/lōʻihi ʻōnaehana kauoha, a ʻo ka mea kaua kahe ʻelima-protocol ka standard huahana a kahi mea hoʻokele booter.
Ke holo nei i nā modula ʻelua ma ka ʻaoʻao like - chalk-tempalte:1.0.19 a 1.0.20 e hoʻomau i ka hoʻouna ʻana i ka mea ʻaihue ʻoiai axois-utils:1.0.9 hoʻouna i ka bot - hōʻike i ka mea hoʻokele e pale ana i nā kahawai loaʻa kālā ma mua o ka haʻalele ʻana i ka Phase A. ʻO ka pivot he hou, aole he pani.
ʻO ka mea a mākou e koi ʻole nei
ʻAʻole hiki iā mākou ke hōʻoia i kahi ʻike honua maoli ma hope o ka deadcode09284814 lawelawe, a ʻaʻole mākou e hāʻawi i kēia hoʻolaha i kekahi mea hana hoʻoweliweli i kapa ʻia, hui, a ʻāina paha. Ua lawa ka kūlike o ka hōʻailona "phantom" ma nā mea hana e hōʻike ai i kahi mea hoʻohana hoʻokahi, akā ʻo ka hoʻouna ʻana i ke ʻano kit o ka binary C2 e waiho ana i ka hiki ke hoʻohana hou nā pūʻolo e hiki mai ana mai nā lawelawe pili ʻole i ke code like.
Hopena, Nā ʻAno Hou a me nā Mea e Pono ai nā Mea Pale e Hana
Ka hopena
ʻO nā pahuhopu squat kūpono axios a kumu hoʻohālike palapala ua hilinaʻi nui ʻia i loko o ka ʻōnaehana JavaScript; axios ʻo ia wale nō ke noho nei ma waena o nā pūʻolo npm i hoʻoiho nui ʻia he kanakolu. ʻO nā inoa typosquat he hoʻokahi kaomi wale nō mai nā mea maoli (ʻAkio ↔ axios, tempalte ↔ UAAIIeIA), a he mau hewa pela kūpono nā mea ʻelua i ka ʻōlelo.
ʻAʻole hiki iā mākou ke loaʻa nā helu hoʻoiho hilinaʻi no nā mana ʻino ma mua o ka lawe ʻia ʻana - ʻaʻole mālama ʻo npm i nā helu hoʻoiho no kēlā me kēia mana ma hope o ka paʻi ʻole ʻia ʻana o kahi pūʻolo, a npms.ioHe walaʻau nā proxy -style ma kēia unahi. ʻO kēlā me kēia hui nona ka lockfile e hoʻoholo i kahi pūʻolo i kapa ʻia ʻAxois-utils or chalk-tempalte mai ka mea hoʻopuka deadcode09284814 pono e mālama ʻia he mea i hoʻopilikia ʻia: e hoʻololi i kēlā me kēia palapala hōʻoia i loaʻa i loko kaʻina hana.env ma ka kikowaena i hoʻopilikia ʻia, e nānā i nā vectors persistence no kēlā me kēia OS (e ʻike i ka "He aha ka mea e hana ai nā mea pale" ma lalo), a wehe i ka hilinaʻi.
Nā ʻano e kū mai ana
Hōʻike kēia hoʻolaha i kahi hoʻololi a mākou i ʻike ai i kekahi mau hanana npm i hala koke nei: ʻo ke ʻano hoʻonohonoho makau ka waiwai paʻa; hiki ke hoʻololi ʻia ka ukanaʻO ka mea hoʻopuka like, ka pūʻolo like, ka like hoʻouka mua / e hoʻohui / ma hope o ke kau ʻana ʻekolu, a ʻoiai ke ʻano like o ka version-bump cadence - ʻo ia wale nō ka mea i loli ma waena axois-utils:1.0.6 a axois-utils:1.0.9 ʻo ia ka faila hooks holo. ʻIke ʻia ma muli o ke kau inoa i hoʻopaʻa ʻia i ka ukana Phase A (nā kaula ala ʻeke, phantom.jsʻO ka mea hōʻiliʻili laina 7,667, ka mea hoʻokipa Serveo C2) e hōʻailona i nā mana mua ʻekolu a hala loa i ka Phase B.
ʻIke ʻia ke ʻano like ma nā hoʻolaha ʻē aʻe o 2026 a mākou i hahai ai: hoʻokahi mea hoʻohana me kahi scaffold paʻa, e hoʻololi ana ma waena o ka ʻaihue palapala hōʻoia, nā mea kūʻai aku hoʻopunipuni hoʻokolohua, Telegram-bot exfil, a i kēia manawa ʻo DDoS recruitment. ʻO nā mea pale e hilinaʻi nei i nā pūlima payload e hoʻomau i ka nalowale ʻana i ka lua o ka puni o kēlā me kēia hoʻolaha.
ʻO ka hopena, ʻo ia ʻO nā TTP manawa hoʻokomo ka hōʻailona maikaʻi aʻe. Nā hoʻolaha hoʻouka-hook ʻekolu, nā palapala hoʻouka e lawe mai ana https or kaʻina hana keiki, e hoʻouka i nā palapala e kākau i nā waihona hoʻomaka mea hoʻohana, a e hoʻouka i nā palapala e hoʻoponopono i nā inoa kikowaena ma nā lawelawe tunnel reverse manuahi (Serveo, localhost.run, ngrok, cloudflared) he mea kakaikahi lākou a pau i nā pūʻolo kūpono a he mea maʻamau i nā mea ʻino.
He aha nā mea e pono ai nā mea pale e hana
- Loiloi faila laka. E huli i kēlā me kēia package-lock.json / laka.wili / pnpm-lock.yaml i loko o kāu hui no nā kaula kikoʻī ʻAxois-utils a chalk-tempalteE mālama i kekahi pāʻani ma ke ʻano he ʻaelike.
- E hoʻohuli i nā mea huna ma luna o nā kikowaena i hoʻopilikia ʻia. ʻO ka Māhele A i hōʻiliʻili nui ʻia ʻo SSH, cloud, GitHub, npm, a me nā hōʻoia wallet. Manaʻo ʻia kēlā me kēia hōʻoia i loaʻa i loko kaʻina hana.env, ~ / .ssh, ~/.aws, ~/.npmrc, ~/.config, a i ʻole kekahi .env* ua hōʻike ʻia ka faila ma ka kikowaena i hoʻopilikia ʻia.
- Wehe i ke kūpaʻa (Pae B). Ma Windows, e holoi HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate, hemo %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\system-update.bat, a schtasks /holoi /tn SystemUpdate /fMa Linux, crontab -e a hemo @reboot node …, systemctl –hoʻopau i ka mea hoʻohana –i kēia manawa phantom-bot.service a laila holoi ~/.config/systemd/user/phantom-bot.service, ʻūlū .bashrc / .zshrc / /etc/rc.localMa ka macOS, launchctl hoʻoiho ~/Library/LaunchAgents/com.phantom.bot.plist a laila e holoi i ka plist.
- E ālai i nā kikowaena C2. E hoʻohui i nā kiko hopena C2 ʻehā ma ka papa IOC i kāu papa inoa poloka egress. *.serveousercontent.com a *.lhr.ola hiki ke ālai ʻia kūʻai nui ʻia inā ʻaʻohe hoʻohana kūpono o kou wahi no nā lawelawe tunnel hoʻohuli.
- ʻImi ma ka manawa hoʻouka TTP, ʻaʻole ka ukana. Nā komo waihona laka nona nā pakete.json hai aku hoʻouka mua, e hoʻohui, a ma hope o ke kau ʻana e kuhikuhi ana nā mea a pau i ka palapala like. E nānā hou i ka makahiki o ka pūʻolo a me ke kūlana hōʻoia o ka mea hoʻopuka. He mea kākaʻikahi kēia ʻano ma nā pūʻolo kūpono a ʻo ia ka hōʻailona hilinaʻi hoʻokahi a PhantomBot e hoʻohana hou ai.
- Loiloi no ka binary C2. ʻO kēlā me kēia mea nāna i hoʻoiho axois-utils:1.0.9 loaʻa iā ia ke kikowaena C2 o ka mea hoʻohana (c2 ELF, sha256 165fa92d…) ma ka disk. E nānā i nā cache a me nā hale kūʻai artifact CI. Ke hiamoe nei ka binary ma o ia iho, akā ʻo kona alo ma kahi workstation he hōʻike maopopo ia ua hoʻokomo ʻia ka pūʻolo.
Laina pani
Hiki i ka mea hoʻohana like, ka pūʻolo like, a me ka makau hoʻonohonoho like ke hāʻawi i nā hoʻoweliweli like ʻole i loko o 48 mau hola. E makaʻala i ke ʻano, ʻaʻole ka ukana.
