Lourenço Santos
@lourenco0 followers267 downloads33 copies0 likes161 views
15 detections
Filters
Last updated
All Time
Detection languages
15
Categories
5
3
3
2
1
Platforms
7
7
5
1
1
Products / Services
4
3
3
2
1
MITRE Techniques
6
6
5
4
4
Detects the confirmed-malicious CRX (Chrome) and XPI (Firefox) extension package hashes for the VPN Go campaign on endpoints. Map to your EDR file-hash field (e.g. Hashes / sha256).
Low-confidence supporting signal. Detects references to the Telegraph privacy-policy path and the actor-controlled email domain associated with the VPN Go extensions. Intended for retro-hunting / enrichment, not standalone alerting.
Detects plaintext HTTP (no TLS) requests to known VPN Go campaign hosts, covering both the clipboard exfiltration endpoint and the /locations proxy-location endpoint. Useful where proxy logs carry the Host header.
Detects indicators of the June 2026 Mastra npm supply chain attack, in which
144 @mastra/* packages were compromised by injecting a typosquatted dependency
'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated
postinstall infostealer. The payload disables TLS validation, fetches a
second-stage payload, executes it as a detached process, and self-deletes.
Detection targets the malicious dependency reference, the postinstall execution
chain, and TLS-validation-disabling behaviour.
144 @mastra/* packages were compromised by injecting a typosquatted dependency
'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated
postinstall infostealer. The payload disables TLS validation, fetches a
second-stage payload, executes it as a detached process, and self-deletes.
Detection targets the malicious dependency reference, the postinstall execution
chain, and TLS-validation-disabling behaviour.
Detects outbound network connections to the attacker-controlled infrastructure
used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign).
IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2
exfiltration server for the cross-platform infostealer.
used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign).
IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2
exfiltration server for the cross-platform infostealer.
Page 2 of 2