Skip to content
Threat Actors Exploit npm Mirrors for Phishing Campaigns

Threat Actors Exploit npm Mirrors for Phishing Campaigns

First seen 25 Aug 2026, 22:22 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •August 26, 2026 at 21:38 UTC
  • •Attackers exploit npm mirrors as free hosting for phishing pages.
  • •24 malicious npm packages identified, impersonating Cloudflare CAPTCHAs.
  • •Phishing domains include login[.]microsofte[.]live and others.

Hackers are leveraging npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs, redirecting users to attacker-controlled sites. OX Security identified 24 npm packages containing these phishing pages, which do not infect users' computers but instead use npm as a free hosting service for the malicious content. The packages are designed to render fake CAPTCHA pages, allowing attackers to bypass security measures by using reputable domains. This technique has been observed since July 2026, with various phishing domains being utilized, including login[.]microsofte[.]live. The malicious pages execute obfuscated JavaScript to redirect visitors to other sites, with some packages remaining live even after being flagged. The current status indicates that while some domains have been blacklisted, attackers can still update existing packages or create new ones to continue their campaigns.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 46d ago How this analysis works

Timeline

2026-07-01
First phishing package identified
Security researcher inf0stache discovered the 'china_airlines' npm package hosting a fake Cloudflare verification page.
BleepingComputer
2026-08-01
OX Security flags 24 malicious packages
OX Security reported 24 npm packages containing identical malicious HTML code designed for phishing.
Cybernews
2026-08-25
BleepingComputer reports on ongoing phishing campaign
BleepingComputer confirmed the use of npm mirrors for hosting phishing pages, detailing the attack method and affected domains.
BleepingComputer
2026-08-26
Gbhackers report on phishing delivery layer
Gbhackers highlighted the ongoing abuse of npm mirrors for hosting phishing pages, confirming the malicious campaign's persistence.
Gbhackers

More articles in this cluster (5)

Following this threat?

Track ClickFix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3