NPM Malware Campaign Uses Adspect Cloaking and Fake CAPTCHAs

The Socket Threat Research Team has uncovered a sophisticated npm malware campaign orchestrated by the threat actor dino_reborn. The campaign uses seven malicious packages to distinguish genuine targets from security researchers before executing payloads. The malware employs traffic cloaking, anti-analysis techniques, and deceptive UI elements, making it difficult for analysts to investigate. The campaign's distinctive feature involves fingerprinting visitor behavior to determine malicious intent, showing security researchers a blank page and potential victims a convincing fake CAPTCHA. The malware targets cryptocurrency platforms, aiming to steal crypto assets. Organizations should monitor for indicators such as /adspect-proxy.php and /adspect-file.php URL patterns.