10 minhigh
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
Threat actors registered corepack.org to impersonate the legitimate Corepack npm tool following its removal from bundled Node.js releases, capitalizing on developer search traffic to distribute malware disguised as a VPN client installer. The payload combines infostealer capabilities (browser data, SSH key access, host/process discovery, PowerShell execution, run-key persistence) with OpenShield proxyware that silently enrolls the host as a bandwidth-sharing proxy node, while a separate redirect chain on the same site delivers adware/trojan-flagged installers through affiliate marketing infrastructure.
Sens:■ Immediate
Showing defanged values
- domainaifpleasurebeh[.]orgDomain identified as part of the malware/affiliate delivery infrastructure
- domainbeadpie[.]xyzDomain identified as part of the malware/affiliate delivery infrastructure
- domaincorepack[.]orgFake Corepack impersonation site serving as the initial phishing/malware delivery landing page
- domainghabovethec[.]infoDomain identified as part of the malware/affiliate delivery infrastructure
- domainmoonlighthathel[.]orgDomain identified as part of the malware/affiliate delivery infrastructure
- domainnostop[.]go2cloud[.]orgAffiliate tracking/redirect infrastructure involved in the adware delivery chain
- domainukankingwithea[.]comDomain identified as part of the malware/affiliate delivery infrastructure
- filenameOperaGXSetup.exeAdware/trojan-flagged payload delivered via a separate malvertising/affiliate redirect path on the same fake site
- filenamevpnsetup_d9gfqvs3dsic73fcvi90.exeFake VPN installer dropped from corepack.org that installs OpenShield proxyware and an infostealer with Apprunner persistence component
- filenamevpnsetup_d9gh5ac3dsic73fmit80.exeVariant filename of the fake VPN installer observed during dynamic analysis, discloses proxyware bandwidth-sharing consent screen
Detection / HunterAnthropic
What Happened
Criminals built a fake website that looks like it belongs to a legitimate developer tool called Corepack, which recently stopped being included automatically with Node.js (a popular programming platform). Developers searching online for how to get Corepack are landing on this fake site and downloading what they think is a VPN app, but it secretly installs software that steals saved passwords and keys from their computer and quietly shares their internet connection with a third-party service, without their knowledge or consent. A second link on the same site pushes different unwanted software through advertising networks. This matters because software developers often have access to sensitive company code and credentials, so a compromised developer machine can lead to bigger breaches. Anyone who downloaded a program from corepack.org should remove it immediately and instead install Corepack only through the official npm registry or the official GitHub project page.
Key Takeaways
- A fake site at corepack.org impersonates the legitimate Node.js Corepack tool, exploiting its 2025 removal from bundled Node.js distributions to capture developers searching for a replacement download.
- The site distributes a fake VPN installer that drops an infostealer (accessing browser profiles and SSH keys) and OpenShield proxyware that enrolls the victim machine as a bandwidth-sharing exit node for data scraping (proxyjacking).
- A second click path on the same domain delivers adware/trojan-flagged installers (e.g., a fake OperaGXSetup.exe) via a malvertising/affiliate redirect chain, indicating dual monetization streams from one fake domain.
- The site's content (FAQ, download button) appears AI-generated and low-quality, confusing 'Yarn' the package manager with yarn the textile craft, yet it still ranks highly in search results for 'corepack'.
- Corepack has no official standalone installer or website; it should only be installed via npm (npm install -g corepack) or obtained from the official nodejs/corepack GitHub repository.
Affected Systems
- Windows developer workstations
- Developers seeking Corepack after its removal from Node.js 25+
- Node.js 24 and earlier users transitioning to standalone Corepack installs
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Developer searches for Corepack after its removal from Node.js and clicks a top search result leading to the fake site corepack.org
- Lure/Redirect: Clicking 'Download Free' redirects to an OpenShield landing page (openshield.canatrace.com) or into a separate malvertising/affiliate chain via freevpn.win and yakteam.xyz
- Delivery: Victim downloads a disguised 'VPN client' installer (vpnsetup_*.exe) or a fake OperaGXSetup.exe depending on the click path
- Execution and Installation: Installer drops OpenShield proxyware plus a persistent Apprunner component; infostealer functionality accesses browser data and SSH keys, performs host/process discovery, and executes PowerShell/command-shell commands
- Persistence: Run-key registry entries establish reboot persistence
- Impact: Host is enrolled as a bandwidth-sharing proxy exit node (proxyjacking) for third-party data scraping while stolen credentials/data are potentially exfiltrated; separate path installs adware/trojan-flagged software
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide YARA, Sigma, Suricata/Snort, KQL, SPL, or EQL detection content. It relies on descriptive dynamic-analysis findings and a list of file/domain indicators rather than formal detection logic.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The described behaviors (browser credential access, SSH key access, host/process discovery, PowerShell execution, run-key persistence) are standard EDR-visible activities, but the specific process ancestry and command lines used were not disclosed in the article, limiting precise signature creation. |
| Network Visibility | Medium | Multiple domains and URLs used in the redirect and delivery chain are disclosed, allowing network-based blocking/detection at proxy or DNS layers, but encrypted proxyware traffic patterns to third-party scraping infrastructure may not be easily distinguished from legitimate VPN/proxy traffic without deeper inspection. |
| Detection Difficulty | Moderate | The malware uses recognizable techniques (run-key persistence, browser data theft, PowerShell execution) that are commonly monitored, but the campaign relies on social engineering and typosquatting rather than novel exploitation, meaning detection depends heavily on web/DNS filtering and user awareness rather than technical exploit signatures. |
Required Log Sources
- DNS query logs
- Web proxy / HTTP(S) request logs
- Windows Registry modification events (Run key creation)
- Process creation logs (Sysmon Event ID 1 / EDR telemetry)
- PowerShell script block/module logging (Event ID 4104)
- File creation/download events
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Search for newly created Run key registry entries associated with recently downloaded executables from unfamiliar or newly registered domains, which may indicate persistence establishment by an infostealer or proxyware client (T1547.001). | Registry modification events, process creation logs correlated with file download events | Persistence | Medium - legitimate software installers also create Run key entries; correlate with domain reputation and file origin. |
| Look for processes accessing browser profile directories (cookies, saved logins) or SSH key directories shortly after execution of a recently downloaded, unsigned or newly-signed executable, suggestive of credential harvesting (T1555.003, T1552.004). | EDR file access telemetry, Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) | Credential Access | Medium - some legitimate password managers and sync tools access these paths; scope to processes with no prior reputation or unusual parent process. |
| Identify hosts establishing persistent outbound connections to proxy/data-scraping infrastructure domains, which could indicate proxyjacking enrollment turning the host into an exit node (T1090). | Network flow logs, DNS logs, proxy logs for long-duration or high-volume outbound connections to unfamiliar domains | Command and Control / Impact | Medium - legitimate VPN or CDN traffic can resemble this pattern; verify against known proxyware domain indicators. |
| Monitor for developer workstations downloading executables (.exe) from domains impersonating well-known open-source tool names not typically distributed as standalone installers (T1204.002, T1583.001). | Web proxy logs, DNS logs, download/file creation events | Initial Access / Delivery | Low - developer tools like Corepack are not normally distributed as .exe installers, making this a fairly distinctive anomaly. |
| Review PowerShell and command-shell execution events spawned shortly after execution of a recently downloaded 'VPN' or utility-branded installer for host/process discovery commands (T1057, T1082, T1059.001). | PowerShell script block logging, command-line auditing, process creation events | Discovery / Execution | Medium - many legitimate installers invoke PowerShell for setup tasks; correlate with unusual discovery command patterns. |
Control Gaps
- Standard web/URL reputation filtering may not flag a newly registered typosquat domain quickly enough before initial downloads occur
- Endpoint allowlisting focused on known-malicious hashes will miss this campaign if hashes rotate frequently across installer variants
- Search engine trust in organic ranking allows malicious domains to appear as top results for legitimate developer tool queries, bypassing user skepticism
- Basic antivirus signature detection may treat proxyware/riskware as low-severity or benign, allowing bandwidth-sharing enrollment to persist undetected
Key Behavioral Indicators
- Unsigned or newly-signed executable named to imply VPN functionality but installed from a non-VPN-branded domain
- New Run key registry persistence entries created immediately following execution of a recently downloaded installer
- Process access to browser profile directories and SSH key folders by a process with no prior reputation history
- Outbound network connections to proxy/data-scraping infrastructure domains following installer execution
- PowerShell or command-shell child processes spawned by a freshly-downloaded installer binary performing host/process discovery
False Positive Assessment
Medium - the described behaviors (Run key persistence, PowerShell execution, browser data access) overlap with legitimate installer and IT tooling behavior, so detections should be scoped to hosts executing recently downloaded, unfamiliar, or low-reputation binaries rather than applied broadly.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting: if any developer downloaded or executed files from corepack.org, isolate the affected host (if your EDR supports host isolation) and initiate credential rotation for browser-stored and SSH credentials on that machine.
- Search endpoint and proxy logs for connections to the disclosed domains and URLs, and for the disclosed filenames, to determine scope of exposure.
- If proxyware/OpenShield components are identified, consider removing them and reviewing outbound network connections for ongoing unauthorized bandwidth sharing.
- Rotate SSH keys and any credentials stored in browser profiles on hosts suspected of compromise, where feasible.
Infrastructure Hardening
- Consider blocking the disclosed domains and URLs at DNS/web proxy layer where applicable to your environment.
- Evaluate whether your organization can enforce that developers install tools like Corepack only via approved package managers (npm) rather than downloading standalone executables from third-party sites.
- Consider implementing application allowlisting or code-signing verification policies for developer workstations to reduce risk from unsigned installer execution.
- Where supported, monitor for and restrict outbound connections to known proxy/bandwidth-sharing services from developer endpoints.
User Protection
- Consider deploying browser/DNS-based protections that flag or block newly registered or low-reputation domains for developer teams.
- If your EDR/antivirus supports it, ensure detection for infostealer and proxyware/riskware categories is enabled and not suppressed as low-severity.
- Encourage developers to verify official installation instructions (e.g., npm install commands, official GitHub repos) before running any installer for open-source tooling.
Security Awareness
- Include this incident as a case study in developer security training, emphasizing that legitimate npm packages like Corepack are not distributed as standalone Windows installers.
- Raise awareness that search engine ranking is not a trust signal, and typosquatted or impersonation domains can rank highly for legitimate tool names.
- Advise developers to verify the source/domain of any tool before downloading and executing installers, especially following changes to how a tool is officially distributed.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Resource Development
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Credential Access
Tactic
Discovery
Tactic
Command and Control
Additional IOCs
- Domains:
moonlighthathel[.]org- Domain identified as part of the malware/affiliate delivery infrastructureaifpleasurebeh[.]org- Domain identified as part of the malware/affiliate delivery infrastructureghabovethec[.]info- Domain identified as part of the malware/affiliate delivery infrastructureukankingwithea[.]com- Domain identified as part of the malware/affiliate delivery infrastructurebeadpie[.]xyz- Domain identified as part of the malware/affiliate delivery infrastructure
Related
Stay currentSubscribe via RSS
