{"id":10547,"date":"2025-10-13T13:28:52","date_gmt":"2025-10-13T06:28:52","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10547"},"modified":"2026-02-05T13:28:59","modified_gmt":"2026-02-05T06:28:59","slug":"175-goi-npm-doc-hai-bi-loi-dung-trong-chien-dich-lua-dao-beamglea","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/10\/13\/175-goi-npm-doc-hai-bi-loi-dung-trong-chien-dich-lua-dao-beamglea\/","title":{"rendered":"175 g\u00f3i npm \u0111\u1ed9c h\u1ea1i b\u1ecb l\u1ee3i d\u1ee5ng trong chi\u1ebfn d\u1ecbch l\u1eeba \u0111\u1ea3o Beamglea"},"content":{"rendered":"<p><b>Trong khi c\u00e1c nh\u00e0 ph\u00e1t tri\u1ec3n v\u1eabn \u0111ang ph\u1ee5 thu\u1ed9c v\u00e0o kho th\u01b0 vi\u1ec7n m\u00e3 ngu\u1ed3n m\u1edf nh\u01b0 npm \u0111\u1ec3 ti\u1ebft ki\u1ec7m th\u1eddi gian l\u1eadp tr\u00ecnh, th\u00ec gi\u1edbi t\u1ed9i ph\u1ea1m m\u1ea1ng l\u1ea1i t\u00ecm ra c\u00e1ch m\u1edbi \u0111\u1ec3 bi\u1ebfn ch\u00ednh n\u1ec1n t\u1ea3ng n\u00e0y th\u00e0nh h\u1ea1 t\u1ea7ng ph\u00e1t t\u00e1n phishing. M\u1ed9t chi\u1ebfn d\u1ecbch tinh vi mang t\u00ean Beamglea v\u1eeba b\u1ecb c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u an ninh m\u1ea1ng ph\u00e1t hi\u1ec7n, cho th\u1ea5y 175 g\u00f3i npm \u0111\u1ed9c h\u1ea1i \u0111\u00e3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 ph\u1ee5c v\u1ee5 cho chi\u1ebfn d\u1ecbch \u0111\u00e1nh c\u1eafp t\u00e0i kho\u1ea3n Microsoft quy m\u00f4 to\u00e0n c\u1ea7u.<\/b><\/p>\n<div style=\"text-align: center\"><a class=\"js-lbImage\" style=\"cursor: pointer\" href=\"https:\/\/whitehat.vn\/attachments\/1760338168995-png.17733\/\" target=\"_blank\" rel=\"noopener\" data-lb-sidebar-href=\"\" data-lb-caption-extra-html=\"\" data-fancybox=\"lb-thread-18828\" data-caption=\"&lt;h4&gt;1760338168995.png&lt;\/h4&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;whitehat.vn&amp;#x2F;threads&amp;#x2F;175-goi-npm-doc-hai-bi-loi-dung-trong-chien-dich-lua-dao-beamglea.18828&amp;#x2F;#post-44346&quot; class=&quot;js-lightboxCloser&quot;&gt;WhiteHat Team \u00b7 13&amp;#x2F;10&amp;#x2F;2025 l\u00fac 2:21 PM&lt;\/a&gt;&lt;\/p&gt;\"><img fetchpriority=\"high\" decoding=\"async\" class=\"bbImage \" title=\"1760338168995.png\" src=\"https:\/\/whitehat.vn\/data\/attachments\/18\/18068-77751e612aa834d189524d985c1c8d0c.jpg\" alt=\"1760338168995.png\" width=\"766\" height=\"400\" \/><\/a>\u200b<\/div>\n<p>Theo b\u00e1o c\u00e1o, c\u00e1c g\u00f3i npm \u0111\u1ed9c h\u1ea1i n\u00e0y \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea3i xu\u1ed1ng h\u01a1n 26.000 l\u1ea7n v\u00e0 ph\u1ea7n l\u1edbn l\u00e0 do c\u00e1c nh\u00e0 ph\u00e2n t\u00edch b\u1ea3o m\u1eadt, h\u1ec7 th\u1ed1ng qu\u00e9t t\u1ef1 \u0111\u1ed9ng ho\u1eb7c CDN ki\u1ec3m tra sau khi c\u00f3 c\u1ea3nh b\u00e1o. Tuy v\u1eady, \u0111i\u1ec1u \u0111\u00e1ng lo ng\u1ea1i l\u00e0 c\u00e1c g\u00f3i n\u00e0y kh\u00f4ng ho\u1ea1t \u0111\u1ed9ng theo c\u00e1ch \u201ctruy\u1ec1n th\u1ed1ng\u201d c\u1ee7a m\u00e3 \u0111\u1ed9c, ch\u00fang kh\u00f4ng t\u1ea5n c\u00f4ng khi \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t, m\u00e0 l\u1ee3i d\u1ee5ng h\u1ea1 t\u1ea7ng h\u1ee3p ph\u00e1p c\u1ee7a npm v\u00e0 UNPKG (m\u1ed9t d\u1ecbch v\u1ee5 CDN c\u00f4ng khai) \u0111\u1ec3 l\u01b0u tr\u1eef v\u00e0 chuy\u1ec3n h\u01b0\u1edbng n\u1ea1n nh\u00e2n \u0111\u1ebfn trang l\u1eeba \u0111\u1ea3o.<\/p>\n<p>Chi\u1ebfn d\u1ecbch nh\u1eafm v\u00e0o h\u01a1n 135 c\u00f4ng ty trong l\u0129nh v\u1ef1c c\u00f4ng nghi\u1ec7p, c\u00f4ng ngh\u1ec7 v\u00e0 n\u0103ng l\u01b0\u1ee3ng tr\u00ean to\u00e0n c\u1ea7u. Nh\u00e0 nghi\u00ean c\u1ee9u Kush Pandya cho bi\u1ebft: \u201cNpm \u0111ang b\u1ecb bi\u1ebfn th\u00e0nh h\u1ea1 t\u1ea7ng v\u00f4 t\u00ecnh ph\u1ee5c v\u1ee5 t\u1ed9i ph\u1ea1m m\u1ea1ng ch\u1ee9 kh\u00f4ng ph\u1ea3i l\u00e0 c\u00f4ng c\u1ee5 t\u1ea5n c\u00f4ng tr\u1ef1c ti\u1ebfp.\u201d<\/p>\n<p>C\u00e1c g\u00f3i npm trong chi\u1ebfn d\u1ecbch Beamglea \u0111\u01b0\u1ee3c t\u1ea1o t\u1ef1 \u0111\u1ed9ng b\u1eb1ng m\u1ed9t \u0111o\u1ea1n m\u00e3 Python c\u00f3 t\u00ean &#8220;redirect_generator.py&#8221;. Script n\u00e0y t\u1ea1o ra c\u00e1c package ng\u1eabu nhi\u00ean c\u00f3 t\u00ean nh\u01b0 \u201credirect-xxxxxx\u201d, sau \u0111\u00f3 ch\u00e8n \u0111\u1ecba ch\u1ec9 email c\u1ee7a n\u1ea1n nh\u00e2n v\u00e0 \u0111\u01b0\u1eddng d\u1eabn trang phishing v\u00e0o trong m\u00e3 ngu\u1ed3n.<\/p>\n<p>Khi g\u00f3i n\u00e0y \u0111\u01b0\u1ee3c xu\u1ea5t b\u1ea3n l\u00ean npm, n\u00f3 s\u1ebd t\u1ea1o ra m\u1ed9t t\u1ec7p HTML ch\u1ee9a li\u00ean k\u1ebft \u0111\u1ebfn m\u00e3 JavaScript \u0111\u1ed9c h\u1ea1i l\u01b0u tr\u00ean CDN c\u1ee7a unpkg.com (v\u00ed d\u1ee5: Unpkg.com\/redirect-xs13nr@1.0.0\/beamglea.js). Khi ng\u01b0\u1eddi nh\u1eadn m\u1edf t\u1ec7p HTML n\u00e0y trong tr\u00ecnh duy\u1ec7t, JavaScript s\u1ebd t\u1ef1 \u0111\u1ed9ng chuy\u1ec3n h\u01b0\u1edbng h\u1ecd \u0111\u1ebfn trang \u0111\u0103ng nh\u1eadp Microsoft gi\u1ea3 m\u1ea1o.<\/p>\n<p>\u0110i\u1ec3m tinh vi l\u00e0 email c\u1ee7a n\u1ea1n nh\u00e2n \u0111\u01b0\u1ee3c truy\u1ec1n s\u1eb5n tr\u00ean URL, khi\u1ebfn tr\u01b0\u1eddng \u0111\u0103ng nh\u1eadp trong trang phishing \u0111\u01b0\u1ee3c t\u1ef1 \u0111\u1ed9ng \u0111i\u1ec1n s\u1eb5n, t\u1ea1o c\u1ea3m gi\u00e1c nh\u01b0 m\u1ed9t c\u1ed5ng \u0111\u0103ng nh\u1eadp h\u1ee3p ph\u00e1p m\u00e0 ng\u01b0\u1eddi d\u00f9ng t\u1eebng truy c\u1eadp. Ch\u00ednh y\u1ebfu t\u1ed1 n\u00e0y gi\u1ea3m \u0111\u00e1ng k\u1ec3 s\u1ef1 nghi ng\u1edd v\u00e0 t\u0103ng t\u1ef7 l\u1ec7 th\u00e0nh c\u00f4ng c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng.<\/p>\n<p>C\u00e1c t\u1ec7p HTML \u0111\u01b0\u1ee3c ng\u1ee5y trang r\u1ea5t k\u1ef9 l\u01b0\u1ee1ng, ch\u00fang mang t\u00ean \u0111\u01a1n h\u00e0ng, t\u00e0i li\u1ec7u k\u1ef9 thu\u1eadt, d\u1ef1 \u00e1n h\u1ee3p t\u00e1c, v.v., khi\u1ebfn n\u1ea1n nh\u00e2n d\u1ec5 tin r\u1eb1ng \u0111\u00e2y l\u00e0 t\u1ec7p n\u1ed9i b\u1ed9 c\u1ea7n xem. Socket cho bi\u1ebft \u0111\u00e3 ph\u00e1t hi\u1ec7n h\u01a1n 630 t\u1ec7p HTML nh\u01b0 v\u1eady trong c\u00e1c g\u00f3i npm b\u1ecb l\u1ee3i d\u1ee5ng.<\/p>\n<p>\u0110i\u1ec1u nguy hi\u1ec3m \u1edf Beamglea n\u1eb1m \u1edf ch\u1ed7 t\u1ed9i ph\u1ea1m m\u1ea1ng kh\u00f4ng c\u1ea7n d\u1ef1ng m\u00e1y ch\u1ee7 ri\u00eang hay thu\u00ea d\u1ecbch v\u1ee5 \u0111\u1ed9c h\u1ea1i. Ch\u00fang d\u1ef1a v\u00e0o ch\u00ednh h\u1ea1 t\u1ea7ng \u0111\u00e1ng tin c\u1eady nh\u01b0 npm v\u00e0 UNPKG \u0111\u1ec3 ph\u00e1t t\u00e1n n\u1ed9i dung. C\u00e1ch l\u00e0m n\u00e0y s\u1ebd:<\/p>\n<ul>\n<li data-xf-list-type=\"ul\">Mi\u1ec5n ph\u00ed ho\u00e0n to\u00e0n: V\u00ec npm v\u00e0 UNPKG l\u00e0 d\u1ecbch v\u1ee5 c\u00f4ng khai.<\/li>\n<li data-xf-list-type=\"ul\">Kh\u00f3 b\u1ecb ch\u1eb7n: Do n\u1eb1m trong h\u1ea1 t\u1ea7ng h\u1ee3p ph\u00e1p, kh\u00f4ng th\u1ec3 c\u1ea5m ho\u00e0n to\u00e0n.<\/li>\n<li data-xf-list-type=\"ul\">Kh\u00f3 ph\u00e1t hi\u1ec7n: V\u00ec g\u00f3i npm kh\u00f4ng ch\u1ee9a m\u00e3 \u0111\u1ed9c tr\u1ef1c ti\u1ebfp khi c\u00e0i \u0111\u1eb7t.<\/li>\n<\/ul>\n<p>N\u00f3i c\u00e1ch kh\u00e1c, Beamglea \u0111\u00e3 bi\u1ebfn npm th\u00e0nh \u201cm\u00e1y ch\u1ee7 mi\u1ec5n ph\u00ed cho phishing\u201d, m\u1ed9t xu h\u01b0\u1edbng nguy hi\u1ec3m v\u00ec n\u00f3 m\u1edf \u0111\u01b0\u1eddng cho c\u00e1c nh\u00f3m tin t\u1eb7c kh\u00e1c t\u00e1i s\u1eed d\u1ee5ng m\u00f4 h\u00ecnh n\u00e0y.<\/p>\n<p>Chi\u1ebfn d\u1ecbch cho th\u1ea5y s\u1ef1 s\u00e1ng t\u1ea1o c\u1ee7a hacker trong vi\u1ec7c t\u1eadn d\u1ee5ng c\u00f4ng c\u1ee5 h\u1ee3p ph\u00e1p. Thay v\u00ec t\u1ea5n c\u00f4ng tr\u1ef1c di\u1ec7n, h\u1ecd \u1ea9n m\u00ecnh trong quy tr\u00ecnh h\u1ee3p ph\u00e1p, khi\u1ebfn h\u1ec7 th\u1ed1ng ki\u1ec3m tra t\u1ef1 \u0111\u1ed9ng kh\u00f3 ph\u00e1t hi\u1ec7n. \u0110\u00e2y kh\u00f4ng ph\u1ea3i l\u1ed7i c\u1ee7a npm, m\u00e0 l\u00e0 v\u1ea5n \u0111\u1ec1 trong c\u00e1ch qu\u1ea3n l\u00fd g\u00f3i v\u00e0 gi\u00e1m s\u00e1t h\u1ea1 t\u1ea7ng m\u00e3 ngu\u1ed3n m\u1edf, v\u1ed1n ng\u00e0y c\u00e0ng b\u1ecb l\u1ea1m d\u1ee5ng cho c\u00e1c chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng gi\u00e1n ti\u1ebfp.<\/p>\n<p>\u0110\u1ec3 tr\u00e1nh tr\u1edf th\u00e0nh n\u1ea1n nh\u00e2n ho\u1eb7c b\u1ecb l\u1ee3i d\u1ee5ng trong chu\u1ed7i t\u1ea5n c\u00f4ng t\u01b0\u01a1ng t\u1ef1, c\u00e1c chuy\u00ean gia khuy\u1ebfn c\u00e1o:<\/p>\n<ul>\n<li data-xf-list-type=\"ul\">Kh\u00f4ng m\u1edf c\u00e1c t\u1ec7p HTML l\u1ea1 \u0111\u01b0\u1ee3c g\u1eedi qua email, \u0111\u1eb7c bi\u1ec7t l\u00e0 c\u00f3 t\u00ean li\u00ean quan \u0111\u1ebfn \u201c\u0111\u01a1n h\u00e0ng\u201d ho\u1eb7c \u201ct\u00e0i li\u1ec7u k\u1ef9 thu\u1eadt\u201d.<\/li>\n<li data-xf-list-type=\"ul\">L\u1eadp tr\u00ecnh vi\u00ean c\u1ea7n ki\u1ec3m tra k\u1ef9 c\u00e1c g\u00f3i npm tr\u01b0\u1edbc khi s\u1eed d\u1ee5ng, tr\u00e1nh c\u00e0i \u0111\u1eb7t t\u1eeb c\u00e1c ngu\u1ed3n kh\u00f4ng r\u00f5 r\u00e0ng ho\u1eb7c c\u00f3 t\u00ean ng\u1eabu nhi\u00ean.<\/li>\n<li data-xf-list-type=\"ul\">Doanh nghi\u1ec7p n\u00ean gi\u00e1m s\u00e1t l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp CDN v\u00e0 ch\u1eb7n c\u00e1c y\u00eau c\u1ea7u b\u1ea5t th\u01b0\u1eddng t\u1edbi unpkg.com ho\u1eb7c c\u00e1c t\u00ean mi\u1ec1n t\u01b0\u01a1ng t\u1ef1.<\/li>\n<li data-xf-list-type=\"ul\">Tri\u1ec3n khai hu\u1ea5n luy\u1ec7n nh\u1eadn di\u1ec7n phishing cho nh\u00e2n vi\u00ean, \u0111\u1eb7c bi\u1ec7t l\u00e0 trong c\u00e1c ng\u00e0nh c\u00f4ng nghi\u1ec7p d\u1ec5 b\u1ecb nh\u1eafm \u0111\u1ebfn.<\/li>\n<\/ul>\n<p>Chi\u1ebfn d\u1ecbch Beamglea cho th\u1ea5y t\u1ed9i ph\u1ea1m m\u1ea1ng kh\u00f4ng ng\u1eebng th\u00edch nghi, ch\u00fang kh\u00f4ng c\u1ea7n t\u1ea1o c\u00f4ng c\u1ee5 m\u1edbi m\u00e0 ch\u1ec9 c\u1ea7n t\u00e1i s\u1eed d\u1ee5ng nh\u1eefng n\u1ec1n t\u1ea3ng h\u1ee3p ph\u00e1p s\u1eb5n c\u00f3. Trong k\u1ef7 nguy\u00ean m\u00e3 ngu\u1ed3n m\u1edf v\u00e0 \u0111i\u1ec7n to\u00e1n \u0111\u00e1m m\u00e2y, r\u00e0o c\u1ea3n gi\u1eefa \u201ch\u1ea1 t\u1ea7ng t\u1ed1t\u201d v\u00e0 \u201cv\u0169 kh\u00ed m\u1ea1ng\u201d tr\u1edf n\u00ean mong manh h\u01a1n bao gi\u1edd h\u1ebft. Ng\u01b0\u1eddi d\u00f9ng v\u00e0 doanh nghi\u1ec7p c\u1ea7n hi\u1ec3u r\u1eb1ng An ninh m\u1ea1ng kh\u00f4ng ch\u1ec9 n\u1eb1m \u1edf vi\u1ec7c ch\u1eb7n m\u00e3 \u0111\u1ed9c, m\u00e0 l\u00e0 hi\u1ec3u \u0111\u01b0\u1ee3c c\u00e1ch k\u1ebb x\u1ea5u \u0111ang l\u1ee3i d\u1ee5ng ch\u00ednh nh\u1eefng g\u00ec ta tin t\u01b0\u1edfng. M\u1ed9t c\u00fa click t\u01b0\u1edfng v\u00f4 h\u1ea1i, nh\u01b0ng c\u00f3 th\u1ec3 l\u00e0 kh\u1edfi \u0111\u1ea7u c\u1ee7a m\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng to\u00e0n c\u1ea7u.<\/p>\n<div style=\"text-align: right\"><b><i>WhiteHat<\/i><\/b>\u200b<\/div>\n<div style=\"text-align: right;margin-top: 16px\"><i>Theo: <a href=\"https:\/\/whitehat.vn\/threads\/175-goi-npm-doc-hai-bi-loi-dung-trong-chien-dich-lua-dao-beamglea.18828\/\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/whitehat.vn\/threads\/175-goi-npm-doc-hai-bi-loi-dung-trong-chien-dich-lua-dao-beamglea.18828\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Trong khi c\u00e1c nh\u00e0 ph\u00e1t tri\u1ec3n v\u1eabn \u0111ang ph\u1ee5 thu\u1ed9c v\u00e0o kho th\u01b0 vi\u1ec7n m\u00e3 ngu\u1ed3n m\u1edf nh\u01b0 npm \u0111\u1ec3 ti\u1ebft ki\u1ec7m th\u1eddi gian l\u1eadp tr\u00ecnh, th\u00ec gi\u1edbi t\u1ed9i ph\u1ea1m m\u1ea1ng l\u1ea1i t\u00ecm ra c\u00e1ch m\u1edbi \u0111\u1ec3 bi\u1ebfn ch\u00ednh n\u1ec1n t\u1ea3ng n\u00e0y th\u00e0nh h\u1ea1 t\u1ea7ng ph\u00e1t t\u00e1n phishing. M\u1ed9t chi\u1ebfn d\u1ecbch tinh vi mang t\u00ean [&hellip;]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-10547","post","type-post","status-publish","format-standard","hentry","category-tin-tuc-cua-vien"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10547","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=10547"}],"version-history":[{"count":0,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10547\/revisions"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=10547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=10547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=10547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}