Researchers found a real phishing campaign abusing npm packages and unpkg mirrors to host a convincing fake Cloudflare CAPTCHA page on a trusted domain. Victims who click the mirrored link are redirected to attacker-controlled infrastructure that could deliver ClickFix-style prompts or credential theft. The actors also rotated their backend from a Microsoft typosquat domain to a legitimate KeyVal service to hide the final redirect destination.
Attackers published 24 npm packages, each containing a single HTML page. The goal was not to infect developers through package installation, but to use npm and mirror services like unpkg as trusted, validated storage for phishing content. Once mirrored, the HTML file renders as a live, fully rendered fake Cloudflare CAPTCHA page hosted on a domain that most users and security tools consider trustworthy. After a victim completes the fake verification step, the page redirects them to attacker-controlled infrastructure, which could deliver ClickFix-style prompts or credential theft.
The page embeds JavaScript that contacts a remote server to determine where to send the victim next. Early versions of this logic pointed to a typosquat domain impersonating the Microsoft login page. After that domain was added to a browser Safe Browsing blocklist, the actors switched to a legitimate third-party service to resolve the final redirect, turning it into what researchers describe as a dead drop resolver. This domain rotation shows how quickly attackers can adapt when one piece of infrastructure gets blocked.
The campaign relies on misplaced trust in domain reputation. A CAPTCHA hosted on a known developer mirror looks legitimate at a glance, and the redirect logic is hidden behind a backend call rather than visible in the link itself. Because the current redirect destination is benign, the page can pass casual inspection while remaining ready to be repointed to malicious content.
Treat any CAPTCHA or verification prompt that redirects elsewhere as suspicious, regardless of the hosting domain's reputation. Encourage employees and developers to report unexpected verification pages so security teams can investigate before the redirect logic is weaponized against benign destinations.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They published 24 npm packages containing a single HTML page, not to infect developers who install them, but to use npm and mirrors like unpkg as trusted, validated storage for phishing content.
The mirrored HTML renders a fake Cloudflare CAPTCHA page on a trusted domain and then redirects victims to attacker-controlled infrastructure, which could deliver ClickFix-style prompts or credential theft.
Early versions contacted a Microsoft-impersonating typosquat domain, but after it was added to a Safe Browsing blocklist, the actors switched to a legitimate service to hide the final redirect destination.
Researchers note the current redirect goes to a benign destination, but warn it could be reconfigured at any time to send victims to phishing or malware pages.
You click a link, see a Cloudflare CAPTCHA on a trusted site, and think, "Safe." That’s exactly the trap. Attackers published npm packages that are just one HTML file. When mirrored on unpkg, that file becomes a fake Cloudflare page that then silently sends you off to their next site. Behind that page, scripts call out to backends like login.microsofte.live or api.keyval.org to decide where to send you next. Today it might land on ChatGPT; tomorrow it could be a ClickFix credential phish. If you ever see a Cloudflare-style CAPTCHA on an unpkg, npm, or other package mirror URL, stop and report it to security, don’t click through.
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
