Seven packages published on the Node Package Manager (npm) registry use the Adspect cloud-based service to separate researchers from potential victims and lead them to malicious locations.

Malicious npm packages use Adspect cloaking and fake CAPTCHAs to fingerprint visitors and redirect victims to crypto-themed scam sites.

Cybersecurity researchers have uncovered seven malicious JavaScript packages on NPM that utilize Adspect, a commercial cloaking service. These packages are

Malicious npm packages use Adspect cloaking to filter victims and deliver crypto-themed redirects.

Malicious npm packages use Adspect cloaking and fake CAPTCHAs to fingerprint visitors and redirect victims to crypto-themed scam sites.

A malware campaign presents fake websites that can check if a visitor is a victim or a researcher, and then proceed accordingly to defraud or evade

Seven packages published on the Node Package Manager (npm) registry use the Adspect cloud-based service to separate researchers from potential victims and lead them to malicious locations.

Seven packages published on the Node Package Manager (npm) registry use the Adspect cloud-based service to separate researchers from potential victims and lead them to malicious locations.

Phishing-as-a-Service (PhaaS) kits will frequently employ one or more techniques to avoid detection by security software. Often they will use a captcha like Cloudflare Turnstile, Google reCAPTCHA, or ...

Rock, tracked by SOCRadar as The Quarry, is a one-person MaaS/PhaaS operation that sells a full phishing and remote access toolkit to affiliates running tax-themed campaigns against U.S. victims. The ecosystem uses legitimate RMM software, Adspect cloaking, and Telegram-based reporting to support campaigns impersonating the IRS, SSA, Adobe, Dropbox, DocuSign, and Messenger. #TheQuarry #Rock #ScreenConnect #Adspect #Telegram #IRS #SSA #Adobe #Dropbox #DocuSign #Messenger

A large-scale malvertising campaign since January 2026 has used Google Ads to lure U.S. tax-searching victims into downloading rogue ConnectWise Control installers that deploy a BYOVD EDR killer called HwAudKiller. The attackers employ stacked cloaking services (Adspect and JustCloakIt) and a legitimately signed Huawei driver (HWAuidoOs2Ec.sys) to blind EDRs, enable LSASS...

A malware campaign presents fake websites that can check if a visitor is a potential victim or a security researcher, and then proceed accordingly to defraud or evade.

Seven packages published on the Node Package Manager (npm) registry use the Adspect cloud-based service to separate researchers from potential victims and lead them to malicious locations.

Cybersecurity researchers have uncovered a set of seven npm packages published by a single attacker. These packages use a cloaking service called Adspect to distinguish between real victims and security researchers, and ultimately redirect to sketchy crypto-themed sites. Malicious npm packages were published by a threat actor named 'dino_reborn' between September and November 2025. Packages include signals-embed (342 downloads), dsidospsodlks (184 downloads), applicationooks21 (340 downloads), application-phskck (199 downloads), integrator-filescrypt2025 (199 downloads), integrator-2829 (276 downloads).

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery RONINGLOADER: DragonBreath’s New Path to PPL Abuse   npm Malware Campaign Uses Adspect Cloaking to Deliver Malicious Redirects  GPT Trade: Fake Google Play Store […]

Cybersecurity researchers have discovered a set of seven npm packages published by a single threat actor that leverages a cloaking service called Adspect to differentiate between real victims and security researchers to ultimately redirect them to sketchy crypto-themed sites. The malicious npm packages, published by a threat actor named "dino_reborn" between September and November 2025, are

Seven packages published on the Node Package Manager (npm) registry use the Adspect cloud-based service to separate researchers from potential victims and lead them to malicious locations. [...]

npm Malware Campaign Uses Adspect Cloaking to Deliver Malicious Redirects

Malicious NPM packages abuse Adspect redirects to evade security

Introduction to a Silent Supply Chain Threat A wave of malicious npm packages has exposed a troubling evolution in JavaScript‑based supply chain attacks. Researchers uncovered seven packages tied to a single threat actor who used a professional-grade cloaking service, Adspect, to selectively target victims while hiding from cybersecurity analysts. This discovery highlights how attackers are now merging ad‑tech cloaking, browser fingerprinting, and open‑source ecosystems into one coordinated operation.

🎯 Introduction A wave of malicious activity has emerged on the Node Package Manager (npm) registry, where seemingly innocent packages are being used to funnel unsuspecting users toward cryptocurrency scams. Researchers have identified seven npm packages that exploit the Adspect cloud-based service to distinguish between security researchers and real victims, redirecting the latter to fraudulent cryptocurrency webpages. This attack highlights the growing sophistication of supply chain threats in the JavaScript ecosystem, targeting both developers and end users.