Security researchers have documented what appears to be the first documented campaign of its kind: threat actors specifically targeting banks through open-source software repositories. Checkmarx spotted the activity during early 2023. The attackers invested heavily in reconnaissance, building fake professional profiles and customizing tools for each victim.
The short version
- First confirmed campaign using open-source packages to hit financial institutions specifically
- Attackers built fraudulent social media accounts to reach out directly to victim staff
- Separate command-and-control infrastructure for each targeted bank
- April 2023 campaign: two malicious npm packages with preinstallation scripts
- February 2023 campaign: distinct bank targeted with a package designed to sit silently until activated
- Second-stage payload: Confusion Framework, a post-exploit toolkit with capabilities similar to Cobalt Strike and Sliver
- Second payload hooked onto a distinctive login form identifier to capture credentials
- Two campaigns assessed as unconnected; malicious package removed after disclosure
- Package name not disclosed publicly
The attack chain
In the April campaign, several packages uploaded to the npm registry contained preinstallation scripts. Once executed, the script determined the host operating system, then fetched a second-stage payload from an external server. The staging URL relied on an Azure CDN subdomain bearing the target bank's name — a technique that lets malicious traffic blend with legitimate cloud requests and slip past simple domain blocklists.
The threat group created fake LinkedIn personas to contact staff at victim banks, lending their operation an air of legitimacy. The contributor profile attached to the malicious package linked back to one of these fabricated pages.
The payload delivered was Confusion Framework, a post-exploit tool with feature parity to popular red-team utilities.
A separate February attack targeted a different financial institution. Here, the malicious npm package was planted to remain dormant until remotely activated. Its payload scanned the bank's login page HTML, identified a specific form element, and attached a credential harvester that transmitted entered usernames and passwords to an external location.
Why this matters
This is supply chain attacks going vertical. Generic npm-based attacks have been common for years, but this campaign shows threat actors investing significant effort in reconnaissance, social engineering, and bespoke tooling to target specific organizations in a specific sector. The use of Azure CDN subdomains to host malware is particularly effective against security tools that rely on domain blocklists.
The February attack is especially worrying. Credential-skimming via a supply chain package that lies dormant on a banking website means the attackers can harvest login data from actual customers — and because the malicious code runs on the legitimate domain, it bypasses most anti-phishing protections.
Checkmarx expects this kind of targeted approach to become more common. Organizations in financial services should treat npm packages from any third-party source as potentially hostile.
Practical example
Say you work at a bank's security operations center. An employee receives a LinkedIn message from someone claiming to be a new vendor contact, asking them to test an npm package for a supposed integration project. The employee installs it on a development machine. The preinstallation script identifies the OS, reaches out to an Azure CDN subdomain that looks legitimate because it contains your bank's name, and downloads Confusion Framework. The attacker now has a foothold in a banking environment, with tooling that blends into normal network traffic.
Key takeaways
- Npm package supply chain attacks are now targeting specific organizations and sectors, not just broad spraying
- Fake LinkedIn profiles are a reconnaissance and social engineering tool; verify vendor contacts through out-of-band channels
- Azure CDN subdomains containing brand names bypass simple domain blocklists; consider subdomain monitoring
- Restrict npm package installation on workstations and CI/CD systems; use private registries with strict allowlists
Frequently asked questions
How did the attackers target specific banks?
The campaign used fake LinkedIn profiles to contact victim employees, specific C2 infrastructure per target, and Azure CDN subdomains containing the bank's name. The level of customization suggests direct reconnaissance against each organization.
What is Confusion Framework?
A post-exploit toolkit with capabilities similar to Cobalt Strike, Sliver, and Brute Ratel — including command execution, lateral movement, and data exfiltration functionality.
How does the login interception technique work?
By hooking onto a distinctive element ID in the login page's HTML structure, the malicious code captured credentials as users submitted them and forwarded the data to an attacker-controlled endpoint.
Were the two attacks connected?
Checkmarx analysts believe the April and February 2023 attacks were not linked — they involved different targets, different tooling, and different techniques.
What can organizations do to defend against this?
Enforce strict npm package allowlists, verify vendor contacts through independent channels, monitor for unexpected Azure CDN subdomain activity, and restrict developer workstation internet access.