TL; DR
nolimit-agent yiphakheji ye-npm enezinguqulo zayo ezishicilelwe — 1.0.299 kuya ku-1.0.307, ekhishwe ezinsukwini ezine kusukela mhla zingama-2026-06-26 kuya kumhla zingama-2026-06-29 — ngayinye iphethe i- uhlaka oluphelele lwe-phishing kanye ne-bulk-mail ngaphakathi kwesiqondisi esifihliwe, esifihliwe ngokuphelele. Kuzo zonke izinguqulo, okufakiwe okuyinhloko kunquma ukuthi .ad/x0.js, elinye lamafayela angu-~86 kufolda enegama le-dotfile ephethe ama-blob e-javascript-obfuscator angaba ngu-4,200 string-array; i-install hook kanye ne-entry layout ziyafana kulo lonke umugqa.
Ngemuva kokufiphala kuhlezi Ukugeleza kwekhodi yedivayisi ye-Microsoft 365 OAuth (login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode) ukuthi, uma ikhodi isivunyiwe, ifunda ibhokisi lokungenayo le-Outlook lesisulu bese ithumela izinto nge-Microsoft Graph API; injini yokuthumela i-SMTP eningi kanye ne-SMS eqhutshwa uhlu lwabamukeli abanikezwa yi-opharetha; amathempulethi omyalezo wokuzenza ongeyena; ukwakhiwa kwesixhumanisi esiqondiswe kabusha; kanye nokuhlola ukusesha ikhodi ye-DNS-over-HTTPS, i-WHOIS, kanye ne-GitHub. Ama-beacon ethrafikhi yesikhathi sokusebenza kuya engqalasizinda ye-opharetha ku- api[.]nolimitent[.]xyz:4100.
Okuthintekile: noma ubani ofaka noma yiluphi uhlobo lwephakheji, nanoma yikuphi Ibhokisi leposi le-Microsoft 365 umnikazi wayo ovuma ikhodi yedivayisi eyethulwe ngayo. Inguqulo yakamuva kakhulu, 1.0.307, iyithegi yakamuva yamanje futhi inekhono elifanayo lebhokisi leposi lekhodi yedivayisi — ikhodi enonya ayigcini nje enguqulweni eyodwa yangemuva.
Ukwehla: okubalulekile. Uhlelo oluthintekile: npmIsibonakaliso esisodwa okufanele usifune kuqala: umsingathi api[.]nolimitent[.]xyz.
Ukuhlasela: ukuthi kusebenza kanjani
Igobolondo elithambile phezu komthwalo ofihliwe
Iphakheji iveza indawo evamile. iphakethe.json imemezela faka okuthunyelwe ihhuku –
text postinstall: node scripts/postinstall.js — futhi lapho kuhlolwa izikripthi/i-postinstall.js ayinangozi: ifaka umyalo we-Windows bese iphuma. I-hook ayikho lapho ukuziphatha kuhlala khona. main futhi am amasimu womabili akhomba ku .ad/, uhlu lwemibhalo olunechashazi elihamba phambili elilugcina lungangeni esimweni esivamile ls okukhiphayo, futhi okuqukethwe kwakho kufihlwe ngomshini ngokulinganayo. Isithwebuli esingaguquki sibalwa ~4,293 sihlanganisa i-encoded-payload spans kulo lonke .ad/ isethi yemojuli; i-javascript-obfuscator kuyi-dependence yokuthuthukiswa emenyezelwe, ehambisana nesimo sokujikeleza kwe-string-array samafayela ahlanganisiwe.
Ukuhlukaniswa kuyisignali yokuqala okufanele iqanjwe: i-hook yokufaka umbuyekezi angayihlola ihlanzekile, kuyilapho ikhodi yokusebenza ikude nohlu olulodwa, ifihliwe futhi ifihliwe, ifinyelelwa kuphela lapho indawo yokungena ethunyelwe yephakheji isebenza.
Ukufinyelela ibhokisi leposi lekhodi yedivayisi ye-Microsoft 365
Imojula .ad/x12.js ithwala ikhono elibaluleke kakhulu lohlaka. Iqhuba imvume yokugunyazwa kwedivayisi ye-Microsoft 365 OAuth 2.0:
text POST login[.]microsoftonline[.]com/common/oauth2/v2.0/devicecode Isibonelelo sekhodi yedivayisi siwukugeleza okusemthethweni kwe-Microsoft okwenzelwe amadivayisi avinjelwe ukufaka: isevisi icela ikhodi, umsebenzisi uthayipha leyo khodi ku- i-microsoft.com/devicelogin` kudivayisi yesibili bese ivuma, bese isevisi ecelayo ithola amathokheni. Uma isevisi ecelayo ingeyomunye umuntu ongeyena umnikazi webhokisi leposi, imvume inika lowo muntu wesithathu ithokheni. Uma ithokheni selitholakele, I-.ad/x12.js` ifunda ibhokisi leposi ngqo nge-Microsoft Graph:
text GET graph[.]microsoft[.]com/v1.0/me/mailFolders/inbox/messages?$top=250&$select=from GET graph[.]microsoft[.]com/v1.0/me/mailFolders/sentitems/messages?$top=250&$select=toRecipients The $khetha Amaphrojekthi adonsa amakheli omthumeli ebhokisini lokungenayo kanye namakheli abamukeli ezintweni ezithunyelwe — izinto zokusetshenziswa zokumaka ababhali besisulu. Lokhu ukufinyelela okuphakathi nendawo (i-AiTM) ngemvume kunokuba kube ngokubamba iphasiwedi: akukho siqinisekiso sokuthola i-phish ngomqondo wakudala, ikhodi kuphela okufanele ivunyelwe.
Injini yeposi enkulu kanye ne-SMS enamathempulethi okuzenza ongeyena
Eduze kokufinyelela ebhokisini leposi kuhlezi umuntu othumela iposi. Iphakheji ithumela amafayela edatha ahlelekayo ku-opharetha — uhlu lwabathumeli (abathumeli.txt, i-smtps.txt) kanye nefayela lesifanekiso (imisebenzi.txt) — amakheli abo afundeka njengephepha lokulingisa: security@apple.com, login-ukuqinisekiswa, isevisi ye-OAuth, ukukhokhisa, kanye nabathumeli bezaziso ze-akhawunti ngokumelene ne- yourdomain.com Umphathi we-stand-in uyayishintsha. Uhlangothi lwe-SMS luphethe ifoniebook kanye nokucushwa kwesango. I-mailer iphinda uhlu lwabamukeli abanikezwa yi-opharetha bese ithumela ngama-relay e-SMTP ahleliwe.
Ukuze izixhumanisi zifike, .ad/xu.js futhi .ad/xq.js yakha ama-URL asebenzisa ukungaqondakali kwe-URL kanye nokulandelela ngokuchofoza. Amaphethini enkohliso afaka igunya elibukeka lithembekile ngaphambi kwe- @ ngakho-ke isiqalo esibonakalayo sihlukile kumphathi wangempela:
text https://trusted[.]com@ https://trusted[.]com%40 https://trusted[.]com:80@ https://redirect[.]example[.]com/ https://track[.]example[.]com/click? Lolu hlaka luphinde luthathe ama-favicon kubathengi abakhulu kanye enterprise abahlinzeki beposi — indlela ejwayelekile yokunikeza isaziso noma ikhasi lokufika elikholisayo elinophawu lomhlinzeki.
Ukuhlola okuqondiwe kanye nengqalasizinda
Amamojula amaningana aqoqa umongo ngaphambi kokuthumela. .ad/x0.js ixazulula amagama nge-DNS-over-HTTPS (dns[.]google/resolve), .ad/xa.js imibuzo ye-WHOIS (api[.]whois[.]vu), Futhi .ad/x9.js isebenzisa usesho lwekhodi ye-GitHub (api[.]github[.]com/search/code?q=) — iphethini ehambisana nokuthola ukucushwa kwe-mail-server eveziwe kanye neziqinisekiso ze-SMTP ukuze kondliwe uhlu lwe-relay. .ad/xs.js ibuza ngenkomba ye-CDX ye-Wayback Machine.
Umyalo nokulawula
Ngaphesheya kwesethi efihliwe, .ad/x4.js ibhekisela endaweni yokugcina yomqhubi:
text http://api[.]nolimitent[.]xyz:4100 Umphathi wabelana ngayo akukho okulinganiselwe uphawu olunegama lomshicileli uqobo, kanye : 4100 i-port iyisiteshi sokushaya ucingo ekhaya lohlaka. Lesi yisibonakaliso esisodwa esihlala isikhathi eside sabavikeli: iphakheji, indawo yokusebenza yonjiniyela, noma i-ejenti yokwakha efinyelela api[.]nolimitent[.]xyz isebenzise le khodi.
Izinkomba zokuvumelana
Izinkomba ezingezansi yilezo umvikeli angazisebenzisa — faka ifayela lokukhiya, vimba i-host, noma usesho lwe-proxy kanye nama-DNS logs. Ama-endpoint e-Microsoft avela ngoba uhlaka luwasebenzisa kabi; awawona wona anonya futhi akufanele avinjwe.
Ama-hashe efayela athathwe ngesikhathi sokuhlunga:
- iphakheji/.ad/x0.js — sha256 e4153bb614ee03ec456e6b5b41926385db6aae0e4f3e771d18e581571ad7ca2a
- iphakheji/iphakheji.json — sha256 8618064f1f6146b4a8f0459aff9154dca1847e3936aa44f4d4cd37e127075644
Isiginali yomqashi ye-Microsoft 365 efanelekile ukuzingela ngaphandle kwale phakheji: ukungena ngemvume kwekhodi yedivayisi okuphumelelayo kulandelwa ngokushesha yiGrafu efundwayo ka Amafolda eposi/ibhokisi lokungenayo futhi Amafolda eposi/ama-sentitems, ikakhulukazi kusukela kuseshini umsebenzisi angayazi.
Ukuchazwa kanye nokuziphatha okubonwe
Okubonakalayo kuhlala kuhlukile kulokho okubangela lokho.
Amaqiniso abonakalayo: iphakheji ishicilelwe ngaphansi kwesibambo i-agent ye-nolimit ngekheli le-Gmail elingaqinisekisiwe futhi kungekho ndawo yokugcina imithombo exhunyiwe; iphakethe.json ichaza ngokuthi “umthumeli we-imeyili othuthukisiwe” futhi iyimaka ngokuthi iqembu elibomvu igama elingukhiye; ikhodi yesikhathi sokusebenza igxile ku-efihliwe, efihliwe .ad/ isiqondisi lapho uchungechunge lwamathuluzi (i-javascript-obfuscator) kuyinto eqinisekisiwe yokuxhomekeka; kanye ne-call-home host api[.]nolimitent[.]xyz iphinda isebenzise akukho okulinganiselwe uphawu. Leli yiphakheji elilodwa elinesakhiwo sengqalasizinda esisodwa esilawulwa ngabaqhubi — akulona iqembu lamaphakheji amaningi, futhi akukho ukufana nomkhankaso oqanjwe ngaphambilini okutholiwe.
The iqembu elibomvu Igama elingukhiye alishintshi ukuhlukaniswa. Amathuluzi okuphepha okuhlaselayo asemthethweni athumela amandla okusebenzisa okubili enza kanjalo ngokusobala: umthombo ofundekayo, ama-target anikezwa yi-opharetha, futhi akukho call-home efihliwe. Leli phakheji liguqula ngayinye yalezo zakhiwo - ikhodi yalo yokusebenza ifihliwe futhi ifihliwe, futhi iqondisa ingqalasizinda ye-opharetha engaguquki kunokuba kube yi-target enikezwa ngumsebenzisi. Ukuziphatha, hhayi ilebula, kulawula isinqumo, esinonya.
Inhloso ayigcizelelwa lapha. Lokhu okuthunyelwe kuchaza lokho okwenziwa yikhodi — ukucela ikhodi yedivayisi, ukufunda ibhokisi leposi ngeGrafu, ukuthumela iposi elikhulu ngama-relay amisiwe, i-beacon kumphathi ohleliwe — futhi kushiya isisusa singashiwongo.
Umthelela, izitayela kanye nesiqondiso sabavikeli
Imiphumela emibili yesikhathi sokufakwa ibalulekile. Okokuqala, noma yimuphi unjiniyela noma i-ejenti ye-CI efakayo i-agent ye-nolimit uletha uhlaka kulowo msingathi bese esungula ikhaya lokubiza ucingo api[.]nolimitent[.]xyzOkwesibili, ikhono lekhodi yedivayisi lifinyelela ngale kwe-host yokufaka: ibhokisi leposi le-Microsoft 365 umnikazi walo okhuthazwa ukuba avume ikhodi eveziwe lifundwa ngqo ngeGrafu, ngaphandle kwephasiwedi ewela ucingo.
Umkhuba obanzi yilowo okufanele ufakwe ngaphakathi. I-phishing yekhodi yedivayisi (i-AiTM) isuke isuka engqalasizinda ye-phishing ezimele yaya kuphakheji ebhukwini lomphakathi — ukusatshalaliswa yi ukufaka i-npm kunokuba kube ngesixhumanisi esithunyelwe nge-imeyili. Ukupakisha ikhithi ngale ndlela kushintshana ngenkinga yokubamba kanye nokulethwa kwezixhumanisi ze-phishing opharetha ukuze kufinyeleleke kurejista, futhi kufihla ikhodi yokusebenza ngemuva kwe-clean install hook kanye ne-dotfile-named obfuscated directory ehlula i-quick manual skim.
Kwabavikeli:
- Ukubuyekezwa kokubhalisa kanye nokuthembela. Phatha iphakheji eliphi main/am ixazululeka ibe yifolda efihliwe (enamachashazi) yekhodi yeqembu lokuqala efihliwe ngokulinganayo njengengozi ephezulu esakhiweni sodwa, kungakhathaliseki ukuthi i-hook yokufaka ibukeka ihlanzekile yini. I-Minification akuyona i-obfuscation — isango kusignesha ye-string-array decoder, hhayi ubude bomugqa.
- Ukuqina kwe-Microsoft 365. Nciphisa ukugeleza kokugunyazwa kwekhodi yedivayisi nge-Conditional Access lapho kungadingeki khona ngokusebenza; izibonelelo zekhodi yedivayisi ziyi-vector eyaziwayo ye-AiTM futhi azidingeki kakhulu ngabasebenzisi abasebenzisanayo. Hlola ukungena ngemvume kwekhodi yedivayisi kulandelwe ukubalwa kwebhokisi leposi le-Graph ngokushesha.
- Ukutholwa kwenethiwekhi. Vimba futhi uxwayise kuvuliwe api[.]nolimitent[.]xyz. Funa ama-DNS aphumayo kanye nama-proxy logs kuwo wonke umthuthukisi kanye nengqalasizinda yokwakha.
- Ukutholwa kwendlela yeposi. The umsebenzisi@umsingathi Amafomu okukhwabanisa i-URL (okuthembekile[.]com@…) ziyatholakala esangweni leposi kanye ne-proxy; izixhumanisi zefulegi ezinengxenye yamandla eyandulela @.
Iphakheji yayibukhoma ngo-npm ngesikhathi sokuhlaziywa. Ngoba uhlaka olufihliwe luhlanganisa wonke umugqa wenguqulo eshicilelwe kanye nolwamanje zakamuva Ithegi (1.0.307) inamandla okusebenzisa ikhodi yedivayisi, ukususwa kwerejistri kufanele kufake yonke inguqulo, hhayi inguqulo eyodwa yangemuva kuphela.
