TL; DR
nolimit-agent ipakeji ye npm ine shanduro dzakaburitswa — 1.0.299 kusvika 1.0.307, yakaburitswa kwemazuva mana kubva 2026-06-26 kusvika 2026-06-29 — imwe neimwe ine hurongwa hwakakwana hwe phishing ne bulk-mail mukati medhairekitori rakavanzika, rakavanzika zvizere. Mune yega yega shanduro, chinhu chikuru chinosarudzwa kuti .ad/x0.js, rimwe remafaira ~86 ari muforodha rine zita rekuti dotfile rine mablob angangoita 4,200 ejavascript-obfuscator string-array; marongerwo einstall hook ne entry akafanana mumutsara wese.
Kuseri kwekusanzwisisika kunogara Kuyerera kwekodhi yemudziyo weMicrosoft 365 OAuth (login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode) kuti, kana kodhi yangobvumidzwa, inoverenga inbox yeOutlook yemunhu anenge abatwa uye inotumira zvinhu kuburikidza neMicrosoft Graph API; injini yekutumira yeSMTP yakawanda neSMS inofambiswa nemazita evanogamuchira vanopihwa nevashandi; matemplate emeseji ekuzvitevedzera; kuvaka kwe open-direct link; uye kuongorora DNS-over-HTTPS, WHOIS, uye GitHub code search. Runtime traffic beacons kune infrastructure yevashandi pa api[.]nolimitent[.]xyz:4100.
Zvakanganiswa: chero ani zvake anoisa chero shanduro yepakeji, uye chero Bhokisi reMicrosoft 365 ine muridzi wayo anotendera kodhi yemudziyo yakapihwa kuburikidza nayo. Shanduro yazvino, 1.0.307, ndiyo tag yazvino uye ine kugona kwakafanana kwebhokisi rema mail re device-code — kodhi yakaipa haina kungogumira kune imwe back-version.
Kusimba: inonyanya kukosha. . Mamiriro ekunze akakanganiswa: npmChiratidzo chimwe chete chekutsvaga chekutanga: mugamuchiri api[.]nolimitent[.]xyz.
Kurwiswa: mashandiro azvo
Goko risina njodzi pamusoro pemutoro wakavanzika
Pakeji yacho inoratidza nzvimbo yakajairika. package.json inozivisa a postinstall chikochekedzo –
text postinstall: node scripts/postinstall.js — uye pakuongororwa zvinyorwa/postinstall.js haina njodzi: inoisa shim yemirairo yeWindows yobuda. Chiredzo hachisi panogara maitiro acho. kuru uye ndiri minda yese inonongedzera mukati .ad/, bhuku rine dot rinotungamira rinoita kuti risave renguva dzose ls zvinobuda, uye zviri mukati mazvo zvakavharidzirwa nemuchina zvakaenzana. Static scanner inoverengwa ~4,293 encoded-payload spans mu .ad/ seti yemodule; javascript-obfuscator ipfungwa yakaziviswa yekuvandudza, inoenderana nechimiro chetambo-array-rotation chemafaira akaunganidzwa.
Kupatsanurwa ndiko chiratidzo chekutanga chakakodzera kutaurwa: hook yekuisa iyo muongorori angaongorora yakachena, nepo kodhi yekushanda iri kure nedhairekitori rimwe chete, yakavanzwa uye yakavanzika, inongosvika chete kana nzvimbo yekupinda yepakeji yapera.
Kupinda mubhokisi retsamba reMicrosoft 365 device-code
Iyo module .ad/x12.js ine kugona kukuru kwehurongwa hwehurongwa. Inotungamira mvumo yeMicrosoft 365 OAuth 2.0 device:
text POST login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode Rubatsiro rwekodhi yemudziyo inzira yepamutemo yeMicrosoft yakagadzirirwa zvishandiso zvinodziviswa kupinda: sevhisi inokumbira kodhi, mushandisi anoisa kodhi iyoyo mu microsoft.com/devicelogin` pamudziyo wechipiri wobvumira, uye sevhisi yekukumbira inogamuchira ma tokeni. Kana sevhisi yekukumbira iri yemumwe munhu asiri muridzi webhokisi retsamba, mvumo inopa munhu wechitatu tokeni. Kana tokeni yangowanikwa, .ad/x12.js` inoverenga bhokisi retsamba zvakananga kuburikidza neMicrosoft Graph:
text GET graph[.]microsoft[.]com/v1.0/me/mailFolders/inbox/messages?$top=250&$select=from GET graph[.]microsoft[.]com/v1.0/me/mailFolders/sentitems/messages?$top=250&$select=toRecipients The $sarudza mapurojekti anodhonza kero dzemutumi kubva mubhokisi rekutumira uye kero dzemugamuchiri kubva pazvinhu zvakatumirwa — zvinhu zvekugadzira mapa evanyoreri vemunhu anenge abatwa. Uku ndiko kuwana kwemuvengi ari pakati (AiTM) nemvumo kwete nekubata password: hapana chitupa che phish mupfungwa yekare, kodhi chete ndiyo inotenderwa.
Injini yekutumira tsamba dzakawanda neSMS ine matemplate ekuita semunhu
Munyoreri wetsamba akapoteredza mailbox. Pakeji iyi inotumira mafaira edata anogona kugadziriswa nevashandi — runyorwa rwevatumi (senders.txt, smtps.txt) uye faira retemplate (mabasa.txt) — ane kero dzenzvimbo dzinoverengwa sepepa rekutevedzera: security@apple.com, login-kusimbisa, OAuth-service, bhiri, uye vanotumira zviziviso zveakaunti vachipesana ne yakodomain.com mushandisi anotsiva. Rutivi rweSMS rune foniebook uye magadzirirwo egedhi. Munyoreri wetsamba anodzokorora runyorwa rwevagamuchiri vanopihwa neoperator uye anotumira kuburikidza nema SMTP relay akagadziriswa.
Kuti zvibatane zvigare pasi, .ad/xu.js uye .ad/xq.js vanogadzira maURL anoshandisa URL pakuongorora kusanzwisisika uye kudzvanya tracking. Maitiro ekunyepedzera anoisa simba rinotaridzika serinovimbwa pamberi pe @ saka prefix inooneka yakasiyana nehost chaiyo:
text https://trusted[.]com@ https://trusted[.]com%40 https://trusted[.]com:80@ https://redirect[.]example[.]com/ https://track[.]example[.]com/click? Chirongwa ichi chinotorawo mafavicons kubva kune vatengi vakuru uye enterprise vanopa tsamba — nzira yakajairika yekuratidza chikumbiro chinogutsa chemupi kana peji rekusvika.
Kuongorora chinangwa nezvivakwa
Mamodule akati wandei anounganidza mamiriro ezvinhu asati atumira. .ad/x0.js inogadzirisa mazita pamusoro peDNS-over-HTTPS (dns[.]google/resolve), .ad/xa.js mibvunzo WHOIS (api[.]whois[.]vu), Uye .ad/x9.js inoshandisa kutsvaga kodhi yeGitHub (api[.]github[.]com/search/code?q=) — patani inoenderana nekuwana magadzirirwo e-mail-server akafumurwa uye SMTP credentials yekupa runyorwa rwerelay. .ad/xs.js inobvunza nezve Wayback Machine's CDX index.
Kurayira uye kutonga
Pakati peseti yakavanzika, .ad/x4.js inoreva nzvimbo yekupedzisira yemushandi:
text http://api[.]nolimitent[.]xyz:4100 Mutariri anogovana zvake hapana muganho zita remuparidzi wacho, uye : 4100 port ndiyo nzira yekufonera kumba yeframework. Ichi ndicho chiratidzo chakasimba kune vadziviriri: package, developer workstation, kana build agent inosvika api[.]nolimitent[.]xyz yashandisa kodhi iyi.
Zviratidzo zvekubvumirana
Zviratidzo zviri pazasi ndizvo zvinogona kushandiswa nemudziviriri — grep a lockfile, block a host, kana search proxy uye DNS logs. Microsoft endpoints inoonekwa nekuti framework inoashandisa zvisina kunaka; ivo pachavo havana hukasha uye havafanirwe kuvharwa.
Mafaira akabatwa panguva ye triage:
- pasuru/.ad/x0.js — sha256 e4153bb614ee03ec456e6b5b41926385db6aae0e4f3e771d18e581571ad7ca2a
- package/package.json — sha256 8618064f1f6146b4a8f0459aff9154dca1847e3936aa44f4d4cd37e127075644
Chiratidzo cheMicrosoft 365 chemutengi chakakodzera kutsvaga pasina kutevedzera iyi package: kupinda-mukati kwekodhi yemudziyo kunobudirira kunoteverwa nekukurumidza neGraph reads ye Mafolda etsamba/bhokisi rekutumira uye MaFolder/manzwi, kunyanya kubva pamusangano uyo mushandisi asingazive.
Hunhu uye maitiro akaonekwa
Zvinoonekwa zvinoramba zvakasiyana nezviri kukonzerwa nezviri kukonzerwa neizvi.
Zvinhu zvinoonekwa: pasuru yacho yakaburitswa pasi pemubato mumiririri we nolimit ine kero yeGmail isina kusimbiswa uye isina nzvimbo yakabatana yekuchengetera manyuko; package.json inotsanangura se "advanced email sender" uye inoiisa nemazita ekuti timu tsvuku keyword; kodhi yenguva yekumhanya yakakamurwa mune yakavanzika, yakavanzika .ad/ dhairekitori rine toolchain yaro (javascript-obfuscator) ipfungwa yakaziviswa yekuvimba; uye host yekufonera kumba api[.]nolimitent[.]xyz anoshandisazve hapana muganho chiratidzo. Iyi ipakeji imwe chete ine chiratidzo chimwe chete chezvivakwa zvinodzorwa nevashandi — kwete boka remapakeji akawanda, uye hapana kuwirirana nekambani yakambotaurwa kare kwakawanikwa.
The timu tsvuku Keyword haichinje kurongwa. Zvishandiso zvekuchengetedza zvepamutemo zvinotumira kugona kwekushandisa kaviri zvinoita izvi pachena: manyuko anoverengwa, zvinangwa zvinopihwa nemushandi, uye hapana call-home yakavanzwa. Iyi package inoshandura chimwe nechimwe chezvinhu izvozvo - kodhi yayo yekushanda yakavharika uye yakavanzwa, uye inoisa chiratidzo kune zvivakwa zvemushandi akasimbiswa pane chinangwa chinopihwa nemushandisi. Maitiro, kwete zita, ndiwo anotonga mutongo, une hutsinye.
Chinangwa hachina kusimbiswa pano. Chinyorwa ichi chinotsanangura zvinoitwa nekodhi - kukumbira kodhi yemudziyo, kuverenga mailbox pamusoro peGraph, kutumira tsamba zhinji kuburikidza nemarelay akagadziriswa, beacon kune fixed host - uye kusiya chikonzero chisina kutaurwa.
Mhedzisiro, mafambiro & gwara rekudzivirira
Mhedzisiro miviri panguva yekuisa inokosha. Chekutanga, chero mugadziri wepurogiramu kana mumiririri weCI anoisa mumiririri we nolimit anounza furemu kune iyo host uye anotanga call-home kuti api[.]nolimitent[.]xyzChechipiri, kugona kwekodhi yemudziyo kunosvika kunze kwehost yekuisa: bhokisi reMicrosoft 365 rine muridzi anokurudzirwa kubvumidza kodhi yakapihwa rinoverengwa zvakananga kuburikidza neGraph, pasina password inomboyambuka waya.
Nzira yakakura ndeyekuisa pfungwa dzako mukati. Kushandiswa kwedhijitari (AiTM) phishing kwachinja kubva pakuva nzira yega ye phishing kuenda pasuru iri pabazi rezveruzhinji — kugoverwa ne npm install pane kushandisa email link. Kurongedza kit nenzira iyi kunochinja dambudziko rephishing operator rekubata nekuunza link kuti risvike kune registry, uye kunovanza operational code kuseri kweclean install hook uye dotfile-named obfuscated directory iyo inokunda quick manual skim.
Kune vadziviriri:
- Ongororo yeRegistry uye kuvimba kwayo. Bata pasuru ine kuru/ndiri inogadziriswa mudhairekitori rakavanzika (dot-prefixed) rekodhi yekutanga yakavanzika seine njodzi huru pachimiro chega, zvisinei nekuti hook yekuisa inoita seichena here. Minification haisi obfuscation — gate riri pasaini ye string-array decoder, kwete pakureba kwemutsetse.
- Kuomesa Microsoft 365. Dzivisai kufambiswa kwemvumo yekodhi yemudziyo neConditional Access kana isingadiwi; ma grants ekodhi yemudziyo anozivikanwa seAiTM vector uye haawanzodiwi nevashandisi vanotaurirana. Ongororai masaini ekodhi yemudziyo mozoteverwa nekuongororwa kweGraph mailbox pakarepo.
- Kuonekwa kwenetiweki. Vhara uye yambiro yakabatidzwa api[.]nolimitent[.]xyzTsvaga maDNS ekunze uye maproxy logs ayo kune vagadziri vemapurogiramu nekuvaka zvivakwa.
- Kuona nzira dzetsamba. The mushandisi@mugamuchiri Mafomu e-URL-spoof (yakavimbika[.]com@…) zvinoonekwa pa mail gateway uye pa proxy; flag links dzine chikamu chechiremera chinotangira @.
Pakeji iyi yaive iripo pa npm panguva yekuongorora. Nekuti hurongwa hwakavanzika hunosanganisira mutsetse wese weshanduro yakabudiswa uye iripo tsva tag (1.0.307) ine kugona kwekodhi yemudziyo, kubviswa kwerejistri kunofanirwa kufukidza shanduro yega yega, kwete shanduro imwe chete yekumashure.
