Date: 07/29/2026
Severity: High
Summary
Attackers used the fake corepack.org website to distribute malware disguised as the legitimate npm Corepack developer tool. The malicious installer deploys an infostealer to steal sensitive data and installs proxyware to abuse victims' internet bandwidth. The campaign demonstrates how fake npm developer-tool websites are increasingly being used to target software developers through supply chain attacks.
Indicators of Compromise (IOC) List
Domain/Urls | aifpleasurebeh.org beadpie.xyz corepack.org freevpn.win ghabovethec.info moonlighthathel.org nostop.go2cloud.org openshield.canatrace.com ukankingwithea.com yakteam.xyz |
File Names | vpnsetup_d9gfqvs3dsic73fcvi90.exe OperaGXSetup.exe |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "aifpleasurebeh.org" or url like "aifpleasurebeh.org" or siteurl like "aifpleasurebeh.org" or domainname like "openshield.canatrace.com" or url like "openshield.canatrace.com" or siteurl like "openshield.canatrace.com" or domainname like "ukankingwithea.com" or url like "ukankingwithea.com" or siteurl like "ukankingwithea.com" or domainname like "yakteam.xyz" or url like "yakteam.xyz" or siteurl like "yakteam.xyz" or domainname like "corepack.org" or url like "corepack.org" or siteurl like "corepack.org" or domainname like "moonlighthathel.org" or url like "moonlighthathel.org" or siteurl like "moonlighthathel.org" or domainname like "freevpn.win" or url like "freevpn.win" or siteurl like "freevpn.win" or domainname like "ghabovethec.info" or url like "ghabovethec.info" or siteurl like "ghabovethec.info" or domainname like "nostop.go2cloud.org" or url like "nostop.go2cloud.org" or siteurl like "nostop.go2cloud.org" or domainname like "beadpie.xyz" or url like "beadpie.xyz" or siteurl like "beadpie.xyz" |
Detection Query 2 : | datasourcename = "Windows Security" and eventtype = "4663" and objectname In ("vpnsetup_d9gfqvs3dsic73fcvi90.exe","OperaGXSetup.exe") |
Detection Query 3: | technologygroup = "EDR" and objectname In ("vpnsetup_d9gfqvs3dsic73fcvi90.exe","OperaGXSetup.exe") |
Reference:
https://socket.dev/blog/fake-corepack-site-distributes-infostealer-and-proxyware