New Phishing Attack Uses AES & Malicious npm Packages to Office 365 Login Credentials

Fortra’s Suspicious Email Analysis (SEA) team uncovered a highly sophisticated phishing campaign targeting Microsoft Office 365 (O365) credentials.

Unlike typical phishing attempts, this attack stood out due to its intricate use of modern technologies and developer infrastructure.

The threat actors employed a multi-layered strategy involving AES (Advanced Encryption Standard) encryption, malicious npm (Node Package Manager) packages, and content delivery networks (CDNs) to execute their scheme.

This marks the first documented instance by Fortra of these tactics being combined to deliver an O365 phishing attack, highlighting a dangerous evolution in cybercriminal methodologies aimed at exploiting unsuspecting users where they are most vulnerable.

A Complex Cyberattack Unveiled

The attack commenced with a seemingly innocuous phishing email containing a malicious .htm file, dubbed “EFT-PMT.htm,” delivered directly to victims’ inboxes.

Beneath its unassuming exterior, the file harbored AES-encrypted code within a variable named “encryptedAthens,” a rare and advanced obfuscation technique in phishing campaigns.

Fortra’s team decrypted this payload using a custom Python script to reveal a URL pointing to JavaScript content hosted on jsDelivr, a popular CDN.

This script was part of a malicious npm package named “citiycar8” (versions 2.1.9 and 2.1.10), disguised as a legitimate open-source library.

Once loaded, the package fetched additional malicious content via a script called “NOW.API.JS,” which personalized phishing URLs using the victim’s email address stored in a variable named “adidas.”

These URLs led victims through a series of redirections some flagged by Cloudflare and tracked via VirusTotal to a counterfeit O365 login page designed to steal credentials.

Technical Depth of the Phishing Operation

Although many of these phishing sites were offline during Fortra’s investigation, historical data from platforms like Any.Run confirmed the attackers’ intent through captured screenshots of the fraudulent login interface.

This abuse of open-source repositories like npm, alongside CDN infrastructure, underscores a growing trend of leveraging trusted developer tools for nefarious purposes, including supply chain attacks and phishing URL distribution.

This campaign’s technical complexity, from encrypted payloads to dynamic phishing links, signals a critical need for heightened cybersecurity vigilance.

Fortra’s analysis reveals how attackers continuously adapt, exploiting trusted systems to bypass detection.

As phishing tactics grow more advanced, organizations must proactively fortify their defenses to identify and mitigate such threats before they inflict harm.

The detailed breakdown of this attack’s components offers valuable insights into the evolving Tactics, Techniques, and Procedures (TTPs) employed by cybercriminals, urging professionals to stay ahead of the curve in safeguarding digital assets.

Indicators of Compromise (IOCs)

Component	Details
EFT-PMT.htm SHA256	5d33bd347d0525731c375048f8cb228cb6ab54bbf883fbc9a862e457a4137653
citiycar8@2.1.9 URL	hxxps[://]cdn[.]jsdelivr[.]net/npm/citiycar8@2[.]1[.]9/MOMENTUM/NOW[.]API[.]JS
citiycar8@2.1.9 Redirects	hxxps[://]natrium100gram[.]site/public/api/page/redirect, hxxps[://]adobe-pending-sign-7834892393293[.]pages[.]dev/#?refid=
NOW.API.JS SHA256 (2.1.9)	35ff658910c0da186ef710711aa1c774756bc6e2855d7783bb2ff0a36edf0308
citiycar8@2.1.10 Redirects	hxxps[://]noirlegacy-panel-1[.]website/uuurrlll, hxxps[://]sun-shine[.]pages[.]dev/#?refid=
NOW.API.JS SHA256 (2.1.10)	8f02b3108099ae84d5c242b5ba061abf04034c893d5841ed8492f3637e57043d

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!