suriyarajn

Part of Microsoft Defender @Microsoft (EPP) Opinions are mine; not my employer's. DM is open

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Security Research is investigating a TerminalFix campaign, a variant of the ClickFix technique, that leads to a reverse-tunnel implant capable of providing network-level proxy access through a compromised host.

This TerminalFix campaign uses fake CAPTCHA verification prompts to facilitate user-executed PowerShell commands. Beyond the initial lure, this campaign uses DLL sideloading through LockScreenContentServer.exe, steganographic payload delivery, and persistence mechanisms. It then performs extensive reconnaissance to identify reachable systems and key infrastructure.

Organizations should investigate devices where users interacted with suspicious CAPTCHA verification prompts and look for unusual execution of LockScreenContentServer.exe, hidden ProgramData folders, and outbound connections associated with the activity.

Additional guidance and technical analysis will be published soon by Microsoft Security Research.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has published an in-depth analysis of the AsyncAPI npm supply chain compromise, from CI/CD compromise to a multi-stage payload that executed at import time, bypassing common npm script-based defenses. Get technical info, along with detection & hunting guidance. https://t.co/PYoI4i7Qp8

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence has observed a supply chain attack targeting the Leo Platform/RStreams npm ecosystem. On June 24, 2026, at 23:04:55 UTC, a compromised maintainer account ("czirker") to publish malicious versions of 20+ npm packages in a coordinated, fully automated operation completed in under three seconds.

Each malicious package ships a tiny binding.gyp and a large index.js, with no postinstall script. The attacker hides the install hook inside node-gyp's command expansion: the binding.gyp sources array contains <!(node index.js > /dev/null 2>&1 && echo stub.c), so npm install runs index.js at build time.

index.js is a three-layer dropper: a ROT char code cipher, then AES-128-GCM (two encrypted blobs), then an obfuscator[.]io toolkit. The loader writes the toolkit to /tmp/p.js and runs it under the Bun runtime (downloaded as v1.3.13), not Node, to sidestep Node-based instrumentation and EDR module load detection.

On a CI runner or workstation, the toolkit:

- Steals runner memory: locates the GitHub Actions Runner.Worker process and reads /proc/{pid}/mem to lift secrets that CI masks in its logs
- Sweeps credentials: AWS, GCP, Azure, HashiCorp Vault, Kubernetes, plus npm, PyPI, RubyGems, JFrog tokens, GitHub PATs, and 1Password
- Exfiltrates with no C2 domain: commits the stolen secrets to an attacker-controlled GitHub repository using the victim's own GitHub token, a "dead drop" that defeats egress domain blocklists
- Self-propagates: republishes any package the victim can publish to, bypassing npm 2FA (bypass_2fa)
- Escalates and persists: on GitHub hosted runners write runner ALL=(ALL) NOPASSWD:ALL for sudo, and injects workflows requesting id-token: write

This attack affects [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], and [email protected].

Microsoft Defender for Endpoint customers should act on these alerts:
- Trojan:JS/MiniShaiHrd[.]ZA!MTB (index.js)
- Trojan:JS/PhantomWorm[.]DA!MTB (binding.gyp)
- Suspicious Node.js process behavior
- Suspicious installation of Bun runtime
- Suspicious usage of Bun runtime
- Suspicious script execution via Bun
- Credential access attempt
- Kubernetes secrets enumeration indicative of credential access

Microsoft Defender for Cloud detects this activity:
- Suspicious supply-chain compromise activity detected
- Suspicious npm supply-chain compromise activity detected

Customers can also check for these IOCs:
- binding.gyp containing <!(node index.js
- index.js carrying a char code array of length 1,566,023
- stray /tmp/p*.js and a freshly downloaded Bun binary during npm install
- outbound to github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/
- runner ALL=(ALL) NOPASSWD:ALL written to sudoers on a runner

To mitigate: Pin to known-good versions, use lockfiles, rotate any secrets exposed to affected CI runners, and review GitHub Actions for unexpected id-token: write or sudoers changes.

[Microsoft Threat Intelligence @MsftSecIntel]

Infostealers like StealC and malware delivery services like Amadey play a central role in intrusions, turning compromises of consumer devices into an enterprise risk. https://t.co/URzmfX5kk2 These threats harvest passwords, cookies, and session tokens that could allow attackers to bypass MFA.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has published an in-depth breakdown of the Mastra npm supply chain compromise, including a detailed analysis of the second-stage payload. Read the blog to get IOCs, along with recommendations for mitigation, detection, and hunting. https://t.co/N2DdLqHsKg

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a supply chain attack on the Mastra-AI npm ecosystem, with 80+ packages compromised through npm account takeover. The attacker introduced a phantom dependency into the compromised packages. The malicious dependency was published by a single anonymous maintainer less than 24 hours ago.

The compromised [email protected] adds the dependency easy-day-js@^1.11.21 (typosquat of "dayjs"), which resolves to v1.11.22. The post-install script runs node setup.cjs, which downloads and executes a remote payload.

The post-install script in [email protected]:

1. Bypasses TLS: Disables SSL verification (NODE_TLS_REJECT_UNAUTHORIZED=0) to communicate with attacker C2 without certificate errors
2. Writes tracking files: Creates ~/.pkg_history (infected machine path) and ~/.pkg_logs (XOR-encoded marker) to prevent re-infection
3. Downloads hidden payload: Fetches second-stage .js from 23[.]254[.]164[.]92:8000/update/49890878
4. Executes as invisible process: Spawns downloaded payload with C2 endpoint 23[.]254[.]164[.]123:443 passed as argument, runs detached and hidden (windowsHide=true)
5. Covers tracks: Deletes setup.cjs to remove all evidence of initial infection

This attack affects [email protected], mastra/pg, mastra/mcp, mastra/schema-compat, mastra/ai-sdk, mastra/rag, and 80+ other packages.

Microsoft Defender for Endpoint customers should monitor and act on alerts with Trojan:JS/ObfusNpmJs in the title. Customers can also check for the following IOCs:
- ls ~/.pkg_history ~/.pkg_logs
- random .js files in home/temp directory

Users are advised to downgrade to previous versions immediately, use [email protected] explicitly, and use lockfiles.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a npm supply chain compromise impacting 90+ redhat-cloud-services/* packages, including patch-client 4.0.4, insights-client 4.0.4, rbac-client 9.0.3, host-inventory-client 5.0.3, frontend-components 7.7.2, and others. The payload is a self-propagating worm that infects other npm packages and self-publishes.

Each compromised package adds a malicious preinstall hook, embedding an index.js script in the package.json that silently executes “node index.js” during installation, downloads Bun, and runs a payload that steals secrets from npm, GitHub, Amazon Web Services (AWS), and Secure Shell (SSH). The added code bloats index.js from ~8KB to ~4.3MB, acting as a heavily obfuscated ROT-9 eval loader.

If any of the compromised packages are installed, users and organizations should assume compromise, rotate credentials, revert to a previously trusted version, and block compromised packages. Identified compromised npm packages have been taken down, and we continue to work with the npm team. Microsoft continues to investigate this attack and will publish updates as more information is available.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has published an analysis of the npm supply chain compromise affecting 32 maliciously modified packages across &gt;90 versions under the redhat-cloud-services npm scope and leading to credential theft and compromise of addt'l maintainer packages: https://t.co/CpFa3iDGL0

[Microsoft Threat Intelligence @MsftSecIntel]

Compromised npm packages ([email protected], [email protected]) are abusing Hugging Face repos as exfiltration infrastructure. The packages deploy a remote access trojan (RAT) that captures keystrokes, screenshots, and crypto wallet credentials.

Indicators of compromise (IOCs):
- npm user: hexalpha10 / author: toskypi
- 195.201.194[.]107:8010 (WebSocket C2)
- c2-toskypi.onrender[.]com (HTTP C2)
- huggingface[.]co/api (exfiltration endpoint)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftSystem64 (persistence)
- MicrosoftSystem64.service (Linux systemd persistence)
- \MicrosoftSystem64 (Windows scheduled task)
- MicrosoftSystem64/payload.js (payload directory)

Defenders: treat unexpected huggingface[.]co/api calls from non-ML workloads as suspicious.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has uncovered a supply chain attack involving malicious npm packages registered under organizational scopes that mirror real internal corporate namespaces, employing dependency confusion technique to deploy a reconnaissance payload. https://t.co/z2GjRIAyYS

A threat actor operating under three maintainer aliases, mr.4nd3r50n, ce-rwb, and t-in-one, published malicious packages that impersonate internal corporate packages, with several spoofing internal enterprise infrastructure URLs in their package.json to appear legitimate.

Once installed, the packages download and execute an obfuscated payload from an attacker-controlled command-and-control (C2) server to collect system information, hostnames, environment variables, and developer context. Read the blog for in-depth analysis and mitigation, detection, and hunting details.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified an active supply chain attack using typosquatted npm packages to steal cloud and CI/CD secrets. On May 28, 2026, a single threat actor operating under newly created maintainer alias vpmdhaj published 14 malicious packages within a 4-hour window. https://t.co/jC3f2m6EBp

The packages typosquat well-known OpenSearch, ElasticSearch, DevOps, and environment-configuration libraries, and several spoof the upstream OpenSearch project’s repository URL in their package.json to appear legitimate.

Once installed, the packages harvest AWS credentials, HashiCorp Vault tokens, and CI/CD pipeline secrets from the host environment. Read the blog from the Microsoft Defender Research team to an in-depth analysis, as well as mitigation, detection, and hunting guidance.

[Microsoft Threat Intelligence @MsftSecIntel]

Over the past year, Microsoft Threat Intelligence observed the persistent growth and operational sophistication of Lumma Stealer, an infostealer malware used by multiple financially motivated threat actors to target various industries. https://t.co/4VkrKnZBJy

[suriyarajn @suriyarajn]

@Hamsinient @VijayFansPage_ @Vijayfansoff @aditi1231 @GoatMovie2024 @GOATMovieOff @ActorVijayFP_ @OTFC_Off @VijayTrendsPage @GOATMovOff @ActorVijayOffcl @Hamsinient

[suriyarajn @suriyarajn]

@Hamsinient @VijayFansPage_ @Vijayfansoff @aditi1231 @GoatMovie2024 @GOATMovieOff @ActorVijayFP_ @OTFC_Off @VijayTrendsPage @GOATMovOff @ActorVijayOffcl Could please release in Bellingham WA.. many Vancouver Canada folks visit and enjoy the movie here.

[suriyarajn @suriyarajn]

@AACreationsUS @PrathyangiraUS @nagashwin7 @Kalki2898AD @VyjayanthiFilms @AACreationsUS @PrathyangiraUS why no cinemark or landmark for south movies. ??? Only for Hindi version we have cineplex/landmark….

[suriyarajn @suriyarajn]

@Hamsinient @Cinemark @Siva_Kartikeyan @arrahman @Ravikumar_Dir @Rakulpreet @kjr_studios @Phantomfxstudio @TheAyalaan @AllIndiaSKFC @Online_SkFc @SKFC_Team @SK_Trends @bejoyraj @KJRuniverse @ActorSK_News @Sk_MediaOffl @Siva_fc @vimalraj9524 Are you releasing in bellingham wa Regal cinemas??

[suriyarajn @suriyarajn]

@PrathyangiraUS @AACreationsUS Are you screening in Bellingham WA Regal ?

[suriyarajn @suriyarajn]

@AACreationsUS @PrathyangiraUS @actorvijay @Dir_Lokesh @anirudhofficial @7screenstudio @AACreationsUS ???????????

[suriyarajn @suriyarajn]

@AACreationsUS @PrathyangiraUS @actorvijay @Dir_Lokesh @anirudhofficial @7screenstudio @AACreationsUS are you screening in Bellingham WA?

[suriyarajn @suriyarajn]

@AACreationsUS @actorvijay @Dir_Lokesh @trishtrashers @anirudhofficial @duttsanjay @akarjunofficial @AACreationsUS

[suriyarajn @suriyarajn]

@AACreationsUS @actorvijay @Dir_Lokesh @trishtrashers @anirudhofficial @duttsanjay @akarjunofficial Are you screening in Bellingham WA ? Many Vancouver folks enjoy good movie experiences if it’s screnning there.