{
  "Event": {
    "analysis": "1",
    "date": "2026-07-24",
    "extends_uuid": "",
    "info": "[Threat Intel] Fake Corepack Site Distributes Infostealer and Proxyware to Developers",
    "protected": false,
    "publish_timestamp": "1785616361",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785616361",
    "uuid": "513fed49-2639-45dd-b64e-29b430d30bfd",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#4985d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9bb6d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#a320c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unsecured Credentials - T1552\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d11f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1552.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0aebeb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150011",
        "to_ids": false,
        "type": "link",
        "uuid": "99223e71-36f9-449c-8c29-c06573bc7ec3",
        "value": "https://socket.dev/blog/fake-corepack-site-distributes-infostealer-and-proxyware"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150011",
        "to_ids": false,
        "type": "text",
        "uuid": "1071d01e-2d7e-419e-838f-74c2f381db85",
        "value": "A fraudulent website impersonating Corepack, the Node.js package manager tool, is distributing malware to developers. The attackers exploit timing around Corepack's removal from Node.js bundling, targeting developers searching for installation instructions. The site offers Windows executables that deliver OpenShield infostealer and proxyware, enrolling victim machines in bandwidth-sharing networks without consent. The payload steals browser credentials, SSH keys, establishes persistence, and routes third-party traffic through compromised systems. An alternative download path delivers adware and trojan components disguised as OperaGX installer. The site features AI-generated content with obvious errors, including confusing Yarn package manager with textile crafts. The domain has been reported to registrars for takedown after community members identified the threat."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150011",
        "to_ids": false,
        "type": "text",
        "uuid": "e7a83217-ccc2-4948-9f72-16244bccc64d",
        "value": "Name: Fake Corepack Site Distributes Infostealer and Proxyware to Developers\nAuthor: AlienVault\nAdversary: \nTags: [\"infostealer\", \"apprunner\", \"typosquatting\", \"supply chain attack\", \"openshield\", \"proxyware\", \"phishing\", \"developer targeting\", \"corepack impersonation\", \"node.js\"]\nTgtd countries: []\nMlwr families: [\"OpenShield\", \"Apprunner\"]\nAttack_ids: [\"T1036.005\", \"T1547\", \"T1204.002\", \"T1566.002\", \"T1082\", \"T1555\", \"T1036\", \"T1552\", \"T1555.003\", \"T1552.004\", \"T1090\", \"T1059\", \"T1204\", \"T1057\", \"T1059.001\", \"T1547.001\", \"T1566\", \"T1090.003\", \"T1203\", \"T1059.003\", \"T1189\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602081",
        "to_ids": true,
        "type": "domain",
        "uuid": "8972e27d-5074-4f73-9653-c5855458d312",
        "value": "corepack.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602102",
        "to_ids": true,
        "type": "url",
        "uuid": "9a1fceb4-d45e-4f3f-add9-629a1f9f46cd",
        "value": "http://freevpn.win/lps/gbox-lp/index.html",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602123",
        "to_ids": true,
        "type": "domain",
        "uuid": "d4c0a88e-c541-49a6-9c1f-63a50a3a3d3f",
        "value": "yakteam.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602144",
        "to_ids": true,
        "type": "url",
        "uuid": "032f9038-a771-4e85-8a7e-54ba2a9c1575",
        "value": "http://openshield.canatrace.com/download-free-can/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...malware-delivery infrastructure: corepack[.]org openshield[.]canatrace[.]com/download-free-can/ freevpn[.]win/lps/gbox-lp/inde...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602165",
        "to_ids": true,
        "type": "domain",
        "uuid": "2460df9f-5522-4c83-9f2b-cd20efde55b5",
        "value": "openshield.canatrace.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...g openshield[.]canatrace[.]com/download-free-can/ freevpn[.]win/lps/gbox-lp/index[.]html moonlighthathel[.]org ai...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602186",
        "to_ids": true,
        "type": "domain",
        "uuid": "3f172436-5489-4909-aae4-21ca581771d6",
        "value": "freevpn.win",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "\"...-free-can/ freevpn[.]win/lps/gbox-lp/index[.]html moonlighthathel[.]org aifpleasurebeh[.]org ghabovethec[.]info ukankingw...\"",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602208",
        "to_ids": true,
        "type": "domain",
        "uuid": "82f87590-9c96-43c2-8f36-714de67a7db8",
        "value": "moonlighthathel.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing and malware-delivery infrastructure",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602229",
        "to_ids": true,
        "type": "domain",
        "uuid": "0a604c64-b9c9-4b97-adef-149b67a6f179",
        "value": "aifpleasurebeh.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing and malware-delivery infrastructure",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602250",
        "to_ids": true,
        "type": "domain",
        "uuid": "b111c0bb-1f7a-4dc6-8faf-6f016a8583e7",
        "value": "ghabovethec.info",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing and malware-delivery infrastructure",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602271",
        "to_ids": true,
        "type": "domain",
        "uuid": "cde2dc48-b40a-499f-9348-c4390d6e93fb",
        "value": "ukankingwithea.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing and malware-delivery infrastructure",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602292",
        "to_ids": true,
        "type": "domain",
        "uuid": "e4798153-4017-48bf-bea9-93cf629e7bae",
        "value": "beadpie.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Phishing and malware-delivery infrastructure",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602314",
        "to_ids": true,
        "type": "domain",
        "uuid": "d6e93200-443e-4356-bea6-f76003a3c4c8",
        "value": "nostop.go2cloud.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}