TL; DR
nolimit-agent yiphakheji ye-npm enenguqulelo ezipapashiweyo — 1.0.299 ukuya ku-1.0.307, ikhutshwe kwiintsuku ezine ukusuka ngomhla wama-2026-06-26 ukuya kumhla wama-2026-06-29 — nganye iphethe ucwangciso olupheleleyo lwe-phishing kunye ne-bulk-mail ngaphakathi kwi-directory efihliweyo, efihliweyo ngokupheleleyo. Kuyo yonke inguqulelo, ingeniso ephambili igqiba ekubeni .ad/x0.js, enye yeefayile ezingama-~86 kwifolda enegama le-dotfile ephethe ii-blobs ezingama-4,200 ze-javascript-obfuscator string-array; i-install hook kunye ne-entry layout ziyafana kumgca wonke.
Emva kwento engaqondakaliyo kuhleli Ukuhamba kwekhowudi yesixhobo seMicrosoft 365 OAuth (login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode) ukuba, yakuba ikhowudi ivunyiwe, ifunda ibhokisi ye-Outlook yexhoba ize ithumele izinto ngeMicrosoft Graph API; injini yokuthumela i-SMTP eninzi kunye ne-SMS eqhutywa luluhlu lwabamkeli ababonelelwa ngumsebenzisi; iitemplate zemiyalezo yokuzenza umntu ongenguye; ukwakhiwa kwekhonkco elivulelekileyo; kunye nokukhangela ikhowudi ye-DNS-over-HTTPS, i-WHOIS, kunye ne-GitHub. Iibhakana zethrafikhi yexesha lokusebenza kwiziseko zomsebenzisi kwi api[.]nolimitent[.]xyz:4100.
Abachaphazelekayo: nabani na ofaka naluphi na uhlobo lwephakheji, kunye naluphi na Ibhokisi yeposi yeMicrosoft 365 umnini wayo uvuma ikhowudi yesixhobo evezwe ngayo. Inguqulelo yamva nje, 1.0.307, yithegi yamva nje kwaye inamandla afanayo ebhokisi yeposi yekhowudi yesixhobo — ikhowudi enobungozi ayiphelelanga kwinguqulelo enye yangasemva.
Ubunzima: lulekeInkqubo yendalo echaphazelekayo: npmIsalathisi esinye ekufuneka sikhangelwe kuqala: i-host api[.]nolimitent[.]xyz.
Uhlaselo: indlela olusebenza ngayo
Iqokobhe elilungileyo phezu komthwalo ofihliweyo
Iphakheji ibonisa umphezulu oqhelekileyo. iphakheji.json ivakalisa postinstall ikhonkco –
text postinstall: node scripts/postinstall.js — kwaye xa kuhlolwa izikripthi/i-postinstall.js ayinabungozi: ifaka i-shim yomyalelo weWindows ize iphume. I-hook ayikho apho kuhlala khona ukuziphatha. eyona kwaye mna amasimi omabini akhomba ku .ad/, uluhlu lweencwadi olunechaphaza eliphambili elilugcina lungangeni kwi-casual ls imveliso, kwaye umxholo wayo ufihliwe ngokulinganayo kumatshini. Iskena esingashukumiyo sibalwa ~4,293 ii-encoded-payload spans kulo lonke .ad/ iseti yemodyuli; javascript-obfuscator luxhomekeko olubhengeziweyo lophuhliso, oluhambelana nesimo sokujikeleza kwentambo-uluhlu lweefayile ezihlanganisiweyo.
Ukwahlulwa luphawu lokuqala olufanele ukubizwa ngalo: i-install hook enokujongwa ngumvavanyi icocekile, ngelixa ikhowudi yokusebenza ikwi-directory enye kude, ifihliwe kwaye ifihliwe, ifikelelwa kuphela xa indawo yokungena ethunyelweyo yephakheji isebenza.
Ukufikelela kwibhokisi yeposi yekhowudi yesixhobo seMicrosoft 365
Imodyuli .ad/x12.js ithwala amandla abaluleke kakhulu esikhokelo. Iqhuba isibonelelo sokugunyaziswa kwesixhobo seMicrosoft 365 OAuth 2.0:
text POST login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode Isibonelelo sekhowudi yesixhobo siyindlela esemthethweni yeMicrosoft eyenzelwe izixhobo ezithintelweyo: inkonzo icela ikhowudi, umsebenzisi uyayibhala ikhowudi kwi i-microsoft.com/devicelogin` kwisixhobo sesibini kwaye ivume, kwaye inkonzo ecelayo ifumana amathokheni. Xa inkonzo ecelayo ingeyomnye umntu ongenguye umnini webhokisi yeposi, imvume inika loo mntu wesithathu ithokheni. Nje ukuba ithokheni ifunyenwe, I-.ad/x12.js` ifunda ibhokisi yeposi ngqo ngeMicrosoft Graph:
text GET graph[.]microsoft[.]com/v1.0/me/mailFolders/inbox/messages?$top=250&$select=from GET graph[.]microsoft[.]com/v1.0/me/mailFolders/sentitems/messages?$top=250&$select=toRecipients The $khetha Iiprojekti zitsala iidilesi zomthumeli kwi-inbox kunye needilesi zomamkeli kwizinto ezithunyelweyo — izinto ezisetyenziswayo xa kudweliswa ababhali bexhoba. Oku kukufikelela kwi-anti-in-the-middle (AiTM) ngemvume kunokuba kuthathwe ngegama lokugqitha: akukho siqinisekiso sokufumana ulwazi nge-phish ngokwendlela yakudala, yikhowudi kuphela eya kuvunywa.
Injini yeposi enkulu kunye ne-SMS enetemplate zokuzenza ongeyena
Kujikeleze ukufikelela kwibhokisi yeposi kuhleli umntu othumela iposi. Iphakheji ithumela iifayile zedatha ezinokuhleleka ngumqhubi — uluhlu lwabathumeli (abathumeli.txt, i-smtps.txt) kunye nefayile yetemplate (imisebenzi.txt) — iidilesi zakhe ezibambi ndawo zifundeka njengephepha lokulinganisa: security@apple.com, login-ukuqinisekiswa, inkonzo ye-OAuth, ukuhlawulisa, kunye nabathumeli bezaziso zeakhawunti ngokuchasene lakho.com umqhubi utshintsha i-stand-in. Icala le-SMS liphethe ifowuniebook kunye noqwalaselo lwesango. I-mailer iphinda uluhlu lwabamkeli abanikezelwa ngumsebenzisi kwaye ithumela ngee-SMTP relays ezicwangcisiweyo.
Ukuze amakhonkco afikelele emhlabeni, .ad/xu.js kwaye .ad/xq.js Yakha ii-URL ezisebenzisa i-URL ekuhlalutyeni ubungqindilili kunye nokulandelela ngokucofa. Iipateni ze-spoof zifaka igunya elibonakala lithembekile ngaphambi kwe- @ ngoko ke isimaphambili esibonakalayo sahlukile kwi-host yokwenyani:
text https://trusted[.]com@ https://trusted[.]com%40 https://trusted[.]com:80@ https://redirect[.]example[.]com/ https://track[.]example[.]com/click? Le nkqubo ikwafumana iifavicons kubathengi abakhulu kunye enterprise ababoneleli ngeposi — yindlela eqhelekileyo yokubonisa umyalezo okanye iphepha lokufika elinophawu lomboneleli.
Ukuhlola iithagethi kunye neziseko zophuhliso
Iimodyuli ezininzi ziqokelela umxholo ngaphambi kokuba zithunyelwe. .ad/x0.js isombulula amagama ngaphezulu kwe-DNS-over-HTTPS (dns[.]google/resolve), .ad/xa.js imibuzo WHOIS (api[.]whois[.]vu), Kunye .ad/x9.js isebenzisa uphendlo lwekhowudi yeGitHub (api[.]github[.]com/search/code?q=) — ipateni ehambelana nokufumanisa uqwalaselo lwe-mail-server eveziweyo kunye neziqinisekiso ze-SMTP ukondla uluhlu lweereyi. .ad/xs.js ibuza nge-CDX index yeWayback Machine.
Umyalelo nolawulo
Ngaphesheya kweseti efihliweyo, .ad/x4.js ibhekisa kwindawo yokugqibela yomqhubi:
text http://api[.]nolimitent[.]xyz:4100 Umninimzi wabelana ngayo akukho mda uphawu olunegama lomshicileli, kunye : 4100 i-port yitshaneli yomnxeba yasekhaya yesakhelo. Olu luphawu olulodwa oluhlala ixesha elide lwabakhuseli: iphakheji, indawo yokusebenza yomphuhlisi, okanye iarhente yokwakha efikelela kuyo api[.]nolimitent[.]xyz isebenzise le khowudi.
Iimpawu zokuvumelana
Ezi mpawu zingasentla zezo umkhuseli anokuthi asebenze kuzo — grep a lockfile, block a host, okanye search proxy kunye ne DNS logs. Ii Microsoft endpoints zivela kuba i framework iyawasebenzisa kakubi; azinabungozi kwaye akufuneki zithintelwe.
Iifayile ezifakwe kwi-triage:
- iphakheji/.ad/x0.js — sha256 e4153bb614ee03ec456e6b5b41926385db6aae0e4f3e771d18e581571ad7ca2a
- iphakheji/iphakheji.json — sha256 8618064f1f6146b4a8f0459aff9154dca1847e3936aa44f4d4cd37e127075644
Isignali yomqeshi yeMicrosoft 365 ekufanele ukuzingela ngaphandle kwale phakheji: ukungena ngempumelelo kwikhowudi yesixhobo kulandelwa ngokukhawuleza yiGraph reads of Iifolda zeposi/ibhokisi engenayo kwaye IiFolda zeposi/ii-sentitems, ingakumbi kwiseshoni umsebenzisi angayiqondiyo.
Ukuchazwa kunye nokuziphatha okubonwayo
Okubonakalayo akubonakali kuxhomekeke ekubeni ngubani obangela oko.
Amaqiniso abonakalayo: iphakheji ipapashwe phantsi kwesiphatho iarhente ye-nolimit enedilesi yeGmail engaqinisekiswanga kwaye kungekho ndawo yokugcina imithombo edibeneyo; iphakheji.json uyichaza “njengomthumeli we-imeyile ophucukileyo” kwaye uyithegise ngolu hlobo iqela elibomvu igama elingundoqo; ikhowudi yexesha lokusebenza igxile kwi-hidden, efihliweyo .ad/ isikhombisi apho isixhobo saso (javascript-obfuscator) luxhomekeko olubhengeziweyo; kwaye i-call-home host api[.]nolimitent[.]xyz iphinda isebenzise akukho mda uphawu. Le yiphakheji enye enesakhiwo esinye esilawulwa ngabaqhubi — asiyoqela leephakheji ezininzi, kwaye akukho kudibana nephulo elalikhankanyiwe ngaphambili okuchongiweyo.
The iqela elibomvu Igama elingundoqo alitshintshi udidi. Izixhobo zokhuseleko olusemthethweni oluthumela amandla okusebenzisa kabini zenza oku ngokucacileyo: umthombo ofundekayo, iithagethi ezibonelelwa ngumsebenzisi, kwaye akukho fowuni efihliweyo. Le phakheji iguqula nganye yezo mpawu - ikhowudi yayo yokusebenza ayicacanga kwaye ifihliwe, kwaye ibhekisa kwiziseko zophuhliso zomsebenzisi ezisisigxina endaweni yethagethi ebonelelwa ngumsebenzisi. Le ndlela yokuziphatha, hayi ilebheli, ilawula isigqibo, esinobubi.
Injongo ayichazwanga apha. Eli nqaku lichaza oko kwenziwa yikhowudi — ukucela ikhowudi yesixhobo, ukufunda ibhokisi yeposi kwiGraph, ukuthumela iposi enkulu ngeerelay ezicwangcisiweyo, ibhena kwi-fixed host — kwaye ishiya injongo ingachazwanga.
Impembelelo, iindlela zokukhokela kunye nesikhokelo sabakhuseli
Iziphumo ezimbini zexesha lokufaka zibalulekile. Okokuqala, nawuphi na umphuhlisi okanye iarhente ye-CI efakayo iarhente ye-nolimit izisa isakhelo kuloo mphathi aze amisele ikhaya lokufowunela api[.]nolimitent[.]xyzOkwesibini, amandla ekhowudi yesixhobo afikelela ngaphaya komsingathi wokufaka: ibhokisi yeposi yeMicrosoft 365 enomniniyo ocelwe ukuba avume ikhowudi enikiweyo ifundwa ngqo kwiGraph, kungekho gama lokugqitha elidlulayo kwintambo.
Eyona ndlela ibanzi yile yokungena ngaphakathi. I-phishing yekhowudi yesixhobo (i-AiTM) isuke kwisiseko se-phishing esizimeleyo yaya kwiphakheji ekwirejista kawonke-wonke — isasazwa yi npm ukufaka endaweni yekhonkco elithunyelwe nge-imeyile. Ukupakisha le khithi ngale ndlela kuthengisa ingxaki yokubamba kunye nokuhanjiswa kweekhonkco zomsebenzisi we-phishing ukuze kufikelelwe kwirejistri, kwaye ifihla ikhowudi yokusebenza ngasemva kwe-clean install hook kunye ne-dotfile-named obfuscated directory eyoyisa i-quick manual skim.
Kwabakhuseli:
- Uphononongo lweRejista kunye nokuxhomekeka. Phatha iphakheji enokuba eyona/mna Isombulula kwi-directory efihliweyo (enamachaphaza angaphambili) yekhowudi yeqela lokuqala efihliweyo ngokulinganayo njengengozi ephezulu kwisakhiwo sodwa, ngaphandle kokuba i-install hook ibonakala icocekile. I-Minification ayisiyo-obfuscation — isango kwisiginitsha ye-string-array decoder, kungekhona kubude bomgca.
- Ukuqina kweMicrosoft 365. Nciphisa ukuhamba kwemvume yekhowudi yesixhobo nge-Conditional Access apho ingafuneki khona; izibonelelo zekhowudi yesixhobo ziyivektha eyaziwayo ye-AiTM kwaye azifuneki rhoqo ngabasebenzisi abasebenzisana nabo. Hlola ukungena kwekhowudi yesixhobo kulandele ubalo lwebhokisi yeposi yeGraph ngoko nangoko.
- Ukufunyanwa kwenethiwekhi. Vimba kwaye ulumkise api[.]nolimitent[.]xyz. Khangela ii-DNS eziphumayo kunye nee-proxy logs kuyo kuphuhliso lwezakhiwo kunye nolwakhiwo.
- Ukufunyanwa kwendlela yeposi. The umsebenzisi@umsingathi Iifom ze-URL-spoof (trusted[.]com@…) ziyafumaneka kwisango leposi kunye ne-proxy; ii-flag links apho icandelo lazo logunya liphambi kwe- @.
Iphakheji yayibukhoma ngo-npm ngexesha lohlalutyo. Kuba isakhelo esifihliweyo sigubungela yonke imigca yenguqulelo epapashiweyo kunye neyangoku zakutshanje Ithegi (1.0.307) inamandla okusebenzisa ikhowudi yesixhobo, ukususwa kwerejistri kufuneka kugqume yonke inguqulelo, kungekuphela nje inguqulelo enye yangasemva.
