John Nowacky
Hackers are launching a fresh wave of attacks aimed at compromising Roblox developers’ systems by using fraudulent npm packages. This latest incident highlights once again how threat actors are exploiting trust in the open-source ecosystem to distribute malware.
In a technical report, Checkmarx researcher Yehuda Gelb revealed that the attackers have created numerous packages that imitate the widely-used ‘noblox.js’ library. These packages have been specifically designed to steal sensitive data and compromise systems. Gelb warned that the attackers have utilized techniques such as brandjacking, combosquatting, and starjacking to create a convincing façade of legitimacy.
The campaign came to light when ReversingLabs first documented its existence in August 2023. It was soon discovered that this campaign was a replay of a similar attack that occurred two years prior, in October 2021, which involved the distribution of a stealer called Luna Token Grabber.
Throughout this year, two additional malicious packages, named noblox.js-proxy-server and noblox-ts, were identified. These packages impersonated the popular Node.js library and delivered stealer malware and a remote access trojan called Quasar RAT.
To make matters worse, the attackers have also employed starjacking, a technique where the fraudulent packages are listed under the actual noblox.js repository, adding further credibility to their malicious intent.
The latest iteration of this attack involves embedding malicious code into the packages, which act as gateways for serving additional payloads hosted on a GitHub repository. Simultaneously, they steal Discord tokens, modify the Microsoft Defender Antivirus exclusion list to avoid detection, and establish persistence by altering Windows Registry settings.
One notable feature of this malware is its persistent nature. By exploiting the Windows Settings app, the malware ensures sustained access to the infected system. As a result, whenever a user attempts to access the Windows Settings app, they unwittingly execute the malware instead.
The ultimate objective of this attack chain is to deploy Quasar RAT, granting the attacker remote control over the compromised system. The stolen information is then sent to the attacker’s command-and-control server via a Discord webhook.
Despite efforts to take down these malicious packages, new ones continue to be published, underscoring the importance of developers remaining vigilant against this ongoing threat.
If you found this article interesting, follow us on Twitter and LinkedIn for more exclusive content.
Additional Facts:
– Roblox is a popular online platform where users can create and play games.
– The ‘noblox.js’ library is a widely-used library by Roblox developers that provides APIs and tools for interacting with the Roblox platform.
– npm is a package manager for JavaScript and is commonly used by developers to install and manage dependencies in their projects.
– Brandjacking is a technique where attackers create fraudulent packages that mimic popular libraries or packages to deceive users into downloading and installing them.
– Combosquatting is a technique where attackers register domain names that are similar to legitimate ones in order to trick users into visiting their malicious websites.
– The term “starjacking” refers to the practice of attackers uploading malicious packages under the name of a legitimate package in a code repository, such as npm.
Key Questions:
1. How are hackers targeting Roblox developers’ systems?
– Hackers are creating fraudulent npm packages that imitate the widely-used ‘noblox.js’ library to steal sensitive data and compromise systems.
2. What techniques are the attackers using to trick users?
– The attackers are using techniques such as brandjacking, combosquatting, and starjacking to create a convincing façade of legitimacy and distribute malware.
3. When did this wave of attacks start?
– The campaign was first documented in August 2023, but it is a replay of a similar attack that occurred in October 2021.
Key Challenges/Controversies:
– One key challenge is the ongoing creation and distribution of new malicious packages despite efforts to take them down. This highlights the need for developers to remain vigilant and take precautions to protect their systems.
Advantages:
– By being aware of these attacks and their techniques, developers can take steps to protect their systems and data from compromise.
– The technical report by Checkmarx researcher Yehuda Gelb provides valuable insights into the tactics used by attackers in this particular campaign.
Disadvantages:
– These attacks can lead to the theft of sensitive data and compromise of systems, potentially causing financial and reputational damage to individuals and organizations.
– The ongoing creation of new malicious packages poses a challenge in terms of timely detection and mitigation.
Related Links:
– Checkmarx Twitter
– Checkmarx LinkedIn
