Back Scworld

Adspect cloaking exploited by npm packages for covert crypto scams

Scworld • November 19, 2025

BleepingComputer reports that the Adspect cloud-based service has been weaponized by seven npm packages published by 'dino_reborn' to clandestinely facilitate cryptocurrency scams.

Half a dozen packages featured code with Adspect cloaking, which is automatically executed due to Immediately Invoked Function Expression wrapping, while the 'signals-embed' package contained code that enabled decoy webpage creation, according to a report from Socket. Included in the inherently nefarious packages' code were anti-analysis functions, such as Ctrl+U, Ctrl+Shift+I, and F12 blocking, as well as page reloading in the event of DevTools detection.

After obtaining visitors' details, including their user agents, URIs, hosts, referrers, and timestamps, the script fetches and forwards the IP address to Adspect API, with users then redirected to bogus CAPTCHA pages with cryptocurrency-related branding, said researchers, who noted that users identified to be researchers have been redirected to a phony but non-malicious Offlido company site.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious npm Packages Use Adspect Cloaking in Crypto Scam A malware campaign has been identified that utilizes malicious npm packages to create fake websites designed to identify and exploit potential victims. The threat actor, known as 'dino_reborn', published these packages between September and November 2025, targeting users in the cryptocurrency space. 13 sources 24

Extracted Entities

Adspect cloaking exploited by npm packages for covert crypto scams

The full story

Extracted Entities

Attack Types (1)

Platforms (2)

Tools (2)