A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25…

A sustained spearphishing campaign abused the npm registry for 5+ months, publishing 27 malicious packages under 6 aliases to deliver browser-executed phishing components. The packages use document.open(), document.write(), and document.close() to replace page content with fake MicroSecure document-sharing verification gates that transition to Microsoft-branded sign-in screens. The attack implements client-side defenses including bot detection checks (navigator.webdriver, plugin counts, screen dimensions), honeypot form fields, and interaction gating requiring mouse/touch input. After credential submission, victims are redirected to threat actor-controlled infrastructure with email identifiers in URL fragments. The campaign uses Adversary-in-the-Middle (AiTM) phishing infrastructure with Evilginx patterns and specific URL paths (/wlc/, /load/, /success/) to capture session cookies and tokens, potentially bypassing traditional MFA.