A new supply chain attack has emerged, targeting developers through the npm package registry. The malicious package, named undicy-http, is designed to deploy a screen-streaming Remote Access Trojan (RAT) and a browser injector that steals session credentials from various platforms.
Key Details of the Attack:
- Malicious Package:
undicy-http - Primary Payload: A native binary called
chromelevator.exewhich employs direct syscalls to bypass EDR and antivirus hooks. - Persistence Mechanisms:
- Creates a scheduled task named
ScreenLiveClient. - Writes registry run keys for persistence.
- Places itself in the Windows Startup folder.
- Creates a scheduled task named
Infection Chain:
- Initial Deployment: When developers install
undicy-http, it checks if it is running as a hidden process and re-launches using VBScript (wscript.exe) to hide execution traces. - Persistence:
- Establishes persistence through scheduled tasks, registry keys, and startup folder entries.
- Anti-Analysis Techniques: Conducts anti-VM checks and looks for analysis tools like Wireshark, IDA, and Ghidra.
- User Deception: Pops up a fake missing
Read the full article at Cyber Security News
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
2
Contents
Ali NematiWritten by Ali
