GoKawiilMicrosoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North Korean hacking group Sapphire Sleet, also known as BlueNoroff.
This attribution comes after Microsoft first disclosed earlier this week that attackers hijacked an npm maintainer account and used it to publish malicious package updates.
"Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector," the company said in a June 19 update.
According to Microsoft, the attack began when threat actors compromised the npm maintainer account "ehindero," which had publishing privileges across the Mastra package environment.
Using the account, the attackers published malicious updates for more than 140 packages in the @mastra scope that injected a malicious dependency named "easy-day-js". This dependency is a typosquat of the legitimate and widely used dayjs JavaScript library.
When the compromised packages were installed, the malicious dependency executed a post-install hook that deployed a malware dropper on developers' devices, ultimately aimed at stealing sensitive credentials, API keys, authentication tokens, and cryptocurrency wallets.
"Once installed, easy-day-js triggered a postinstall hook that executed an obfuscated dropper script, disabled Transport Layer Security (TLS) certificate verification, contacted attacker-controlled command-and-control (C2) infrastructure, downloaded a second-stage payload, and executed the payload as a detached hidden process," explains Microsoft.
Cross-platform malware targets crypto wallets
The downloaded second-stage payload was a cross-platform information stealer designed to target Windows, Linux, and macOS systems
The implant collected information about the host, browser histories, installed applications, and running processes, and checked whether 166 cryptocurrency wallet browser extensions were installed, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink.
... continue reading