OX Security identified and is tracking a fake Cloudflare Captcha campaign that can potentially distribute ClickFix malware through npm, and found 24 distinct malicious packages sharing the exact same malicious code.
Overview
The OX Research team is tracking a fake Cloudflare campaign being distributed on the npm registry: Our research found a total of 24 packages containing the same HTML page, with each package usually reaching between 50-300 weekly downloads before it gets removed. But downloading and installing such a package to a machine doesn’t do any harm, so why do we bother researching it?
While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn’t do harm, the threat actor’s use of npm isn’t to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware.
Packages are automatically mirrored through sites like unpkg, yarn, npmmirror, tencent and more. Some of them are exposing the package files directly on their servers, not just the package’s “tgz” zip. This means that anyone who opens those links that sit on an npm mirror will see a fully rendered HTML page on a secure and trusted website (the npm mirror) – thus making them free frontend hosts for malicious HTML pages and potentially other payloads as well.
Recommended Actions
- Treat npm mirror domains (unpkg, npmmirror, yarn, tencent) as potential phishing hosts when not used for downloading package mirrors.
- Add mirror URLs to phishing detection and URL-reputation pipelines.
- Check proxy and DNS logs for direct .html requests to mirror domains that sit inside the mirrored packages themselves.
Technical Analysis
When opening the HTML page, we’re shown a fake Cloudflare verification page, then redirected to an external website controlled by the threat actor’s remote server.
The HTML page source has logic for presenting the fake security verification, alongside obfuscated JavaScript code that sends a request to a remote server.
In the original version of the malware, it would send a request to a typosquatted Microsoft domain – login[.]microsofte[.]live
This domain was blacklisted after the first wave of the malware. When opening it in a web browser, we received the following message stating that it’s malicious:
In later versions of the malware, it uses a different domain name – https://api.keyval.org – a legitimate domain used to store key-value pairs, which the threat actor is using to get an encrypted value from the remote server and decrypt it – then loads the URL and browse to it.
Currently the remote logic transfers the user to the legitimate ChatGPT website, but it could be weaponized to deliver ClickFix or any other phishing domains when configured to by the attacker.
You can see that when mirror sites like unpkg mirror packages with HTML pages, users can browse to them directly – showing how effective it can be to use npm and it’s mirrors not just for npm malware, but for payload storage and phishing attacks on trusted domains
https://unpkg[.]com/ndmxchdjxn2@1.0.0/index.html
Affected Packages
| Package | Published (UTC) | Family | Status |
|---|---|---|---|
| bgzxcuite2 | 2026-08-04 07:17 | Microsoft Typosquat | Taken down |
| prezdentkxheiw | 2026-08-06 06:22 | Microsoft Typosquat | Taken down |
| egair0810 | 2026-08-10 07:35 | Microsoft Typosquat | Taken down |
| mnteckets | 2026-08-10 11:02 | Microsoft Typosquat | Taken down |
| airdzticket | 2026-08-11 08:17 | Microsoft Typosquat | Taken down |
| egypt0811 | 2026-08-11 09:06 | Microsoft Typosquat | Taken down |
| passport811 | 2026-08-11 09:21 | Microsoft Typosquat | Taken down |
| vxhjkseuiaqkb | 2026-08-13 01:35 | Microsoft Typosquat | Live |
| ndmushdkeqe | 2026-08-13 07:57 | Microsoft Typosquat | Live |
| ndmxchdjxn2 | 2026-08-13 08:32 | Microsoft Typosquat | Live |
| ndmfguyhoxc3 | 2026-08-13 08:44 | Microsoft Typosquat | Live |
| mjsdqwocvn | 2026-08-14 02:28 | Microsoft Typosquat | Live |
| m2fcsfyjkuxb | 2026-08-14 02:53 | Microsoft Typosquat | Live |
| m3fdfocdoewn | 2026-08-14 04:13 | Microsoft Typosquat | Live |
| @worrisome/reutil | 2026-08-14 07:14 | keyval new logic | Live |
| testdgdbcsd | 2026-08-14 08:03 | Microsoft Typosquat | Live |
| tesgfvbncsdbcv | 2026-08-14 08:08 | Microsoft Typosquat | Live |
| mndsxcusiwlk1 | 2026-08-17 02:47 | keyval new logic | Live |
| mn2adskhweox | 2026-08-17 03:13 | keyval new logic | Live |
| mn3sadkoiewu | 2026-08-17 04:01 | keyval new logic | Live |
| mn4xcouzvhus | 2026-08-17 08:17 | keyval new logic | Live |
| mbxcnsuwgs1 | 2026-08-24 03:03 | keyval new logic | Live |
| skxcmwuncbg2 | 2026-08-24 04:02 | keyval new logic | Live |
| mobiwaefhxc3 | 2026-08-24 06:52 | keyval new logic | Live |
IOCs
- login[.]microsofte[.]live
- api.keyval.org
- Please note that keyval.org is not malicious by itself, but can be used to store malicious payloads
- PpihAtpV1i29jeS3Skk7XU74X2Zkd5wyzF2DOzY77k1Fz7G
- NvGafkxVGs+z6VOGy6E43n+JQgKSUsn+S5NjXlBmcq4=
Conclusions
Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data.
When we think of malware as families of code that steal data directly from the machine they are running on, we can miss other ideas such as infrastructure abuse, using npm and its mirrors as free storage, and persistence – since npm packages can live forever in mirrors even after they are removed from the official stores.
While our analysis catches a small glimpse of what actors can do, we can expect more clever ways of abusing the npm registry to follow as long as registration and package uploads remain free, making it an easy target for actors to use and abuse.
References
An earlier evolution of this campaign was flagged by osj on X/Twitter (@inf0stache), and later covered by IntelFusions. Some of the packages are also referenced in OSV and GitHub Advisories – though the description stating that “any computer that has this package installed or running should be considered fully compromised” is misleading. Installing the packages is harmless; victims can only be infected after being redirected to a ClickFix or phishing page.
