TL; DR
nolimit-agent bụ ngwugwu npm nke mbipụta ya ebipụtara — 1.0.299 site na 1.0.307, ewepụtara ya n'ime ụbọchị anọ site na 2026-06-26 ruo 2026-06-29 — nke ọ bụla nwere a usoro phishing zuru oke na bulk-mail n'ime ndekọ zoro ezo, nke zoro ezo nke ọma. Na nsụgharị ọ bụla, ntinye bụ isi na-ekpebi .ad/x0.js, otu n'ime faịlụ ~86 dị na folda aha ya bụ dotfile nke nwere ihe dị ka 4,200 javascript-obfuscator string-array blobs; njikọ ntinye na nhazi ntinye yiri nke ahụ n'ofe ahịrị ahụ.
N'azụ ihe mkpuchi ahụ ka dị Usoro koodu ngwaọrụ Microsoft 365 OAuth (login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode) na, ozugbo akwadoro koodu, na-agụ igbe ozi Outlook nke onye ahụ metụtara ma ziga ihe site na Microsoft Graph API; nnukwu SMTP na igwe izipu SMS nke ndepụta ndị nnata onye ọrụ na-akwado; ndebiri ozi nke ụdịdị; owuwu njikọ mepere emepe; na nyocha na nchọta koodu DNS-over-HTTPS, WHOIS, na GitHub. Ihe ngosi okporo ụzọ oge na akụrụngwa onye ọrụ na api[.]nolimitent[.]xyz:4100.
Ihe metụtara: onye ọ bụla nke tinyere ụdị ọ bụla nke ngwugwu ahụ, na ihe ọ bụla Igbe ozi Microsoft 365 onye nwe ya kwadoro koodu ngwaọrụ ewepụtara site na ya. Ụdị kachasị ọhụrụ, 1.0.307, bụ akara kachasị ọhụrụ ugbu a ma nwee otu ikike igbe ozi ngwaọrụ - koodu ọjọọ ahụ abụghị naanị otu ụdị azụ.
Ogo: oké egwuUsoro gburugburu ebe obibi ndị metụtara: npmOtu ihe ngosi ị ga-ebu ụzọ chọọ: onye ọbịa api[.]nolimitent[.]xyz.
Mwakpo ahụ: otu o si arụ ọrụ
Mkpuru dị nro n'elu ibu zoro ezo
Ngwugwu ahụ na-egosi elu nkịtị. ngwugwu.json na-ekwupụta a nrụnye mgbe etinyere nko –
text postinstall: node scripts/postinstall.js — na nyocha na scripts/postinstall.js ọ dịghị njọ: ọ na-etinye ihe ngosi iwu Windows wee pụọ. Nko ahụ abụghị ebe omume ahụ dị. isi na Abụ ubi abụọ ahụ na-ezo aka na .ad/, ndekọ nke akara ngosi ya na-eme ka ọ ghara ịdị mfe ls ihe a na-emepụta, na ihe dị n'ime ya nke igwe na-ekpuchi otu ihe ahụ. Ihe nyocha ahụ gbakọrọ ihe dịka ~4,293 nke e tinyere koodu na ya na-agafe n'ofe .ad/ modulu setịpụ; javascript-obfuscator bụ ndabere mmepe a kpọsara, nke dabara na ụdị ntụgharị eriri-array-rotation nke faịlụ ndị a kpọkọtara ọnụ.
Nkewa ahụ bụ akara mbụ kwesịrị aha: njikọ nrụnye nke onye nyocha ga-enyocha dị ọcha, ebe koodu arụmọrụ dị n'otu ndekọ, zoro ezo ma zoo, erute naanị mgbe ebe ntinye nke ngwugwu ahụ na-agba ọsọ.
Ntinye koodu igbe ozi ngwaọrụ Microsoft 365
Modul .ad/x12.js Ọ na-ebu ikike kachasị mkpa nke usoro ahụ. Ọ na-akwalite ikike ngwaọrụ Microsoft 365 OAuth 2.0:
text POST login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode Onyinye koodu ngwaọrụ bụ usoro Microsoft ziri ezi nke e mere maka ngwaọrụ ndị a na-egbochi ntinye: ọrụ na-arịọ koodu, onye ọrụ na-ede koodu ahụ. microsoft.com/devicelogin«Na ngwaọrụ nke abụọ wee kwado, ọrụ arịrịọ ahụ na-anata tokens. Mgbe ọrụ arịrịọ ahụ bụ nke onye ọzọ na-abụghị onye nwe igbe ozi, nkwenye na-enye onye nke atọ token. Ozugbo enwetara token, .ad/x12.js` na-agụ igbe ozi ahụ ozugbo site na Microsoft Graph:
text GET graph[.]microsoft[.]com/v1.0/me/mailFolders/inbox/messages?$top=250&$select=from GET graph[.]microsoft[.]com/v1.0/me/mailFolders/sentitems/messages?$top=250&$select=toRecipients The $họrọ atụmatụ na-adọta adreesị onye zitere ozi site na igbe mbata na adreesị onye nnata site na ihe ezitere - ihe eji eme eserese maka ndị na-ezigara onye ihe metụtara. Nke a bụ ohere onye iro-n'etiti (AiTM) site na nkwenye kama ijide paswọọdụ: enweghị asambodo iji phish n'echiche ochie, naanị koodu ka a ga-akwado.
Injin ozi na SMS buru ibu nwere ndebiri e ji eme ihe
N'akụkụ igbe ozi dị, e nwere onye na-ezipụ ozi. Ngwugwu ahụ na-ebufe faịlụ data onye ọrụ nwere ike idezi — ndepụta onye na-eziga ozi (senders.txt, smtps.txt) na faịlụ ndebiri (ọrụ.txt) — onye adreesị onye na-edebe ebe ya dị ka mpempe akwụkwọ maka iṅomi mmadụ: security@apple.com, login-nkwenye, ọrụ OAuth, ịkwụ ụgwọ, na ndị na-eziga ọkwa akaụntụ megide yourdomain.com onye ọrụ na-anọchi anya ya. Akụkụ SMS ahụ nwere ekwentịebook na nhazi ọnụ ụzọ ámá. Onye na-eziga ozi na-emegharị ndepụta ndị nnata nke onye ọrụ nyere ma na-eziga site na relays SMTP ahaziri.
Iji mee ka njikọ daa, .ad/xu.js na .ad/xq.js wuo URL ndị na-eji ihe mgbagwoju anya na-eme nyocha URL na ịpịa ihe. Usoro aghụghọ ndị ahụ na-etinye ikike a pụrụ ịtụkwasị obi tupu @ ya mere prefix a na-ahụ anya dị iche na ezigbo onye nnabata:
text https://trusted[.]com@ https://trusted[.]com%40 https://trusted[.]com:80@ https://redirect[.]example[.]com/ https://track[.]example[.]com/click? Usoro a na-adọta favicons n'aka ndị ahịa buru ibu na enterprise ndị na-enye ozi - usoro a na-emekarị maka ịnye ngwa ngwa ma ọ bụ ibe ọdịda nke onye na-enye ọrụ na-eme ka o doo anya.
Nyocha ebumnuche na akụrụngwa
Ọtụtụ modulu na-achịkọta ihe dị n'ime ya tupu izipu ya. .ad/x0.js na-edozi aha na DNS-over-HTTPS (dns[.]google/dozie), .ad/xa.js ajụjụ WHOIS (api[.]whois[.]vu), na .ad/x9.js na-agba ọsọ ọchụchọ koodu GitHub (api[.]github[.]com/search/code?q=) — ụkpụrụ nke kwekọrọ na ịchọpụta nhazi ozi-sava ekpughere na asambodo SMTP iji nye ndepụta relay. .ad/xs.js ajụjụ gbasara ndeksi CDX nke Wayback Machine.
Iwu na njikwa
N'ofe ihe mkpuchi ahụ, .ad/x4.js na-ezo aka na njedebe onye ọrụ:
text http://api[.]nolimitent[.]xyz:4100 Onye ọbịa ahụ kesara ya onye na-enweghị oke akara nwere aha onye mbipụta ahụ, na : 4100 ọdụ ụgbọ mmiri bụ ọwa oku ụlọ nke usoro ahụ. Nke a bụ otu ihe ngosi kacha sie ike maka ndị na-agbachitere: ngwugwu, ebe ọrụ onye nrụpụta, ma ọ bụ onye nnọchite anya owuwu na-eru. api[.]nolimitent[.]xyz agbaala koodu a.
Ihe ngosi nke nkwekọrịta
Ihe ngosi ndị dị n'okpuru bụ ndị onye nchekwa nwere ike ime ihe na ha - grep a lockfile, block a host, ma ọ bụ search proxy na DNS logs. Ihe njedebe Microsoft na-apụta n'ihi na usoro ahụ na-emebi ha; ha abụghị ihe ọjọọ n'onwe ha, ekwesighikwa igbochi ha.
E jidere hash faịlụ na nhazi:
- ngwugwu/.ad/x0.js — sha256 e4153bb614ee03ec456e6b5b41926385db6aae0e4f3e771d18e581571ad7ca2a
- ngwugwu/ngwugwu.json — sha256 8618064f1f6146b4a8f0459aff9154dca1847e3936aa44f4d4cd37e127075644
Ihe ngosi ndị nwe ụlọ Microsoft 365 kwesịrị ịchọgharị n'adabereghị na ngwugwu a: nbanye ngwaọrụ na-aga nke ọma, nke Graph na-agụ ozugbo. folda ozi/igbe mbata na faịlụ ozi/ihe mmetụta uche, ọkachasị site na nnọkọ onye ọrụ anaghị amata.
Ngosipụta na omume a hụrụ
Ihe a na-ahụ anya na-anọpụ iche na onye nọ n'azụ ya.
Eziokwu ndị a na-ahụ anya: a na-ebipụta ngwugwu ahụ n'okpuru aka ahụ onye nnọchi anya nolimit nwere adreesị Gmail a na-anaghị enyocha na enweghị ebe nchekwa njikọ; ngwugwu.json na-akọwa ya dị ka "onye na-eziga ozi email dị elu" ma na-akpọ ya aha na otu ọbara ọbara isi okwu; koodu oge ọsọ a na-elekwasị anya na nzuzo, nke zoro ezo .ad/ ndekọ nke ngwaọrụ ya (javascript-obfuscator) bụ ntụkwasị obi a kpọsara; na onye nnabata oku-ụlọ api[.]nolimitent[.]xyz na-ejigharị ihe ndị ọzọ onye na-enweghị oke ika. Nke a bụ otu ngwugwu nwere otu ihe owuwu njikwa nke onye ọrụ na-achịkwa — ọ bụghị otu ngwugwu nwere ọtụtụ ngwugwu, a chọpụtaghịkwa njikọ ya na mkpọsa akpọrọ aha mbụ.
The otu ọbara ọbara okwu mmalite anaghị agbanwe nhazi. Ngwaọrụ nchekwa mwakpo ziri ezi nke na-ebuga ikike ojiji abụọ na-eme nke a n'ụzọ doro anya: isi mmalite a na-agụ, ebumnuche ndị ọrụ na-enye, na enweghị oku-ụlọ zoro ezo. Ngwugwu a na-agbanwe ihe onwunwe nke ọ bụla - koodu ọrụ ya ezochiri ezochi ma zoo, ọ na-egosikwa akụrụngwa onye ọrụ edobere kama ebumnuche onye ọrụ na-enye. Omume ahụ, ọ bụghị akara ahụ, na-achịkwa mkpebi ahụ, nke bụ ihe ọjọọ.
E kwughị ebumnuche ebe a. Ozi a na-akọwa ihe koodu ahụ na-eme - ịrịọ maka koodu ngwaọrụ, gụọ igbe ozi n'elu Graph, ziga ozi buru ibu site na relays ahaziri, beacon nye onye ọbịa edobere - ma hapụ ihe kpatara ya ka ọ ghara ịpụta ìhè.
Mmetụta, usoro na nduzi onye na-agbachitere
Mmetụta abụọ dị mkpa maka oge nrụnye. Nke mbụ, onye nrụpụta ọ bụla ma ọ bụ onye nnọchi anya CI nke na-etinye onye nnọchi anya nolimit na-eweta usoro ahụ n'ahụ onye ọbịa ahụ ma guzobe ebe a na-akpọ oku api[.]nolimitent[.]xyzNke abụọ, ikike koodu ngwaọrụ ahụ na-agbatịkwu karịa onye na-ebunye ya: igbe ozi Microsoft 365 nke onye nwe ya kpaliri ịkwado koodu ewepụtara na-agụ ozugbo site na Graph, na-enweghị paswọọdụ ọ bụla gafere waya ahụ.
Usoro sara mbara bụ nke a ga-eme ka ọ dị n'ime. phishing koodu ngwaọrụ (AiTM) agbanweela site na akụrụngwa phishing nkeonwe gaa na ngwugwu na ndekọ ọha - nkesa site na npm tinye kama iji njikọ email. Nchikota ngwa a na-agbanwe nsogbu nnabata na nnyefe njikọ nke onye ọrụ phishing ka ọ ghara iru ndekọ ahụ, ma zoo koodu ọrụ n'azụ nko nrụnye dị ọcha na ndekọ faịlụ a na-akpọ dotfile nke na-emeri obere skim aka.
Maka ndị na-agbachitere:
- Nyocha ndekọ na ịdabere. Jiri ngwugwu nke isi/Abụ na-edozi n'ime ndekọ zoro ezo (nke nwere ntụpọ) nke koodu nke mbụ nke e zoro ezo nke ọma dị ka ihe egwu dị elu naanị na nhazi ahụ, n'agbanyeghị ma nko nrụnye ahụ ọ dị ọcha. Mbelata abụghị ihe mgbochi - ọnụ ụzọ dị na mbinye aka decoder eriri, ọ bụghị n'ogologo ahịrị.
- Mmesi ike nke Microsoft 365. Machibido usoro ikike ngwaọrụ site na iji Nnweta Ọnọdụ ebe a na-achọghị ya n'ọrụ; onyinye koodu ngwaọrụ bụ ihe a ma ama nke AiTM, ndị ọrụ mmekọrịta anaghị achọkarị ya. Nyocha maka nbanye koodu ngwaọrụ wee soro nyocha igbe ozi Graph ozugbo.
- Nchọpụta netwọk. Gbochie ma gbaa mbọ hụ na api[.]nolimitent[.]xyzChọọ ndekọ DNS na proxy maka ya n'ofe onye nrụpụta ma wuo akụrụngwa.
- Nchọpụta ụzọ ozi. The onye ọrụ@onye nnabata Ụdị URL-spoof (tụkwasịrị obi[.]com@…) enwere ike ịchọpụta ya n'ọnụ ụzọ ámá ozi na proxy; njikọ ọkọlọtọ nke ihe mejupụtara ikike ya na-ebu ụzọ @.
Ngwugwu ahụ dị ndụ na npm n'oge nyocha ahụ. N'ihi na usoro zoro ezo na-agbasa ahịrị mbipụta niile ebipụtara na nke ugbu a. ọhụrụ mkpado (1.0.307) nwere ikike koodu ngwaọrụ, iwepụ ndekọ kwesịrị ikpuchi ụdị ọ bụla, ọ bụghị naanị otu ụdị azụ.
