Skip to navigation

Threat reportMalwareTL-2026-1676

Fake Corepack.org Site Distributes OpenShield Infostealer/Proxyware to Developers; Secondary Malvertising Chain Delivers OperaGXSetup.exe Adware

highACTIVE

A malicious site impersonating the legitimate corepack.org domain lures developers searching for Node.js's standalone Corepack tool (after its removal from Node.js 25+) into downloading an OpenShield-branded 'free VPN client' installer that is actually an infostealer/proxyware combo. The infostealer harvests browser-profile data and SSH keys and can execute PowerShell/shell commands, while the proxyware silently enrolls the victim machine as a bandwidth-sharing proxy exit node for third-party data-scraping traffic (proxyjacking).

Key facts for OpenShield Corepack VPN lure

IdentifiersTL-2026-1676
Also known asOpenShield Infostealer Campaign, Fake Corepack Campaign
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsN/A (typosquat/impersonation site) corepack.org (fake site impersonating Node.js Corepack); Microsoft Windows (target OS for delivered .exe payloads)
MalwareOpenShield
MITRE ATT&CK techniquesT1005 Data from Local System, T1016 System Network Configuration Discovery, T1036.005 Match Legitimate Resource Name or Location, T1041 Exfiltration Over C2 Channel, T1057 Process Discovery, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1071.001 Web Protocols, T1082 System Information Discovery, T1090.003 Multi-hop Proxy, T1189 Drive-by Compromise, T1204.002 Malicious File and 9 more in the attack flow
MotivationFINANCIAL
Target sectorstechnology, software development
Target regionsGlobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for OpenShield Corepack VPN lure

As of 2026-07-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1676 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake VPN/Corepack Installer Download and Execution from Typosquat Domain

Detects download and first execution of the 'vpnsetup' or 'OperaGXSetup' branded installers sourced from the fake corepack.org / openshield.canatrace.com / go2cloud.org malvertising chain, catching the initial drive-by/user-execution stage of the OpenShield infostealer/proxyware campaign.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1189, T1204.002, T1036.005
  • Data sources: proxy, pan:threat, stream:http, sysmon
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy sourcetype="pan:threat" OR sourcetype="stream:http"
| eval domain=coalesce(dest_hostname, url_domain, http_host)
| search domain IN ("corepack.org","*.canatrace.com","openshield.canatrace.com","freevpn.win","moonlighthathel.org","aifpleasurebeh.org","ghabovethec.info","ukankingwithea.com","beadpie.xyz","yakteam.xyz","*.go2cloud.org")
| join type=left dest_ip [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*vpnsetup*.exe" OR TargetFilename="*OperaGXSetup.exe") | rename Computer as dest_ip ]
| stats earliest(_time) as first_seen latest(_time) as last_seen count by domain, TargetFilename, dest_ip, user
| where isnotnull(TargetFilename)
| sort - last_seen

Microsoft KQL

let badDomains = dynamic(["corepack.org","canatrace.com","openshield.canatrace.com","freevpn.win","moonlighthathel.org","aifpleasurebeh.org","ghabovethec.info","ukankingwithea.com","beadpie.xyz","yakteam.xyz","go2cloud.org"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (badDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName endswith "vpnsetup.exe" or FileName has "vpnsetup" or FileName =~ "OperaGXSetup.exe"
    | project FileCreateTimestamp = Timestamp, DeviceName, FileName, FolderPath, SHA256
) on DeviceName
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, FileName, FolderPath, SHA256

Sigma

title: Fake Corepack/OpenShield VPN Installer Downloaded From Known Malicious Domain
id: 3a9d4d1e-4c8a-4d2a-9f7e-1a2b3c4d5e6f
status: experimental
description: Detects network connections to the fake corepack.org / OpenShield / go2cloud.org malvertising infrastructure immediately followed by creation of a vpnsetup*.exe or OperaGXSetup.exe file, indicating the initial drive-by download stage of the OpenShield infostealer/proxyware campaign.
references:
    - https://socket.dev/blog/fake-corepack-site-distributes-infostealer-and-proxyware
    - https://github.com/nodejs/corepack/issues/803
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/24
tags:
    - attack.initial-access
    - attack.t1189
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: file_event
    product: windows
detection:
    selection_domain:
        Initiated: 'true'
    selection_file:
        TargetFilename|contains:
            - 'vpnsetup'
            - 'OperaGXSetup.exe'
        TargetFilename|endswith: '.exe'
    condition: selection_file
falsepositives:
    - Legitimate Opera GX browser installer downloaded from opera.com (verify SHA256 and referrer domain before alerting)
level: high

Known false positives:

  • Legitimate Opera GX installer downloaded directly from opera.com rather than the go2cloud.org redirect chain

Tuning notes: Keep the domain watchlist updated as new redirector domains for this campaign are identified; correlate with proxy referrer chains showing 3+ hops ending in an .exe download.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • PowerShell Child Process Spawned by Recently Downloaded VPN/Utility Installer · unlock with TL Creds
  • Browser Credential Store and SSH Key Directory Access by Recently Downloaded Installer · unlock with TL Creds
  • Registry Run Key Persistence Added by Fake VPN/OperaGX Installer · unlock with TL Creds
  • Host and Network Discovery Sweep Following Fake VPN Installer Execution · unlock with TL Creds
  • Collected Data Archived by Recently Downloaded Installer Prior to Exfiltration · unlock with TL Creds
  • Sustained Low-and-Slow Outbound Connections Consistent With Proxyware Bandwidth-Hijacking Beacon · unlock with TL Creds
  • SEO-Poisoned Corepack Search Result Click-Through to Malware Landing Page · unlock with TL Creds
  • Deceptive 'Your File Download Is Ready' Interstitial Preceding Adware Executable Delivery · unlock with TL Creds

Indicators of compromise for OpenShield Corepack VPN lure

As of 2026-07-24, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-1676.

Sample indicators (3 of 21)

  • Domain: corepack[.]org
  • Domain: canatrace[.]com
  • Domain: freevpn[.]win

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

21 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for OpenShield Corepack VPN lure

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How OpenShield Corepack VPN lure works

A parallel malvertising/affiliate-redirect chain (go2cloud.org tracking infrastructure) pushes a trojanized OperaGXSetup.exe adware/PUP payload to the same visitors.

In March 2026 the Node.js `corepack` GitHub repository (issue #803) flagged https://corepack.org as a fake, malicious impersonation of the project's official documentation presence, warning users not to access it. Socket's Threat Research team (Kirill Boychenko and Sarah Gooding) subsequently analyzed the site and published findings on 2026-07-24 showing it had evolved from a low-effort informational page into an active malware distribution vector.

The campaign directly exploits a supply-chain-adjacent trust gap: the Node.js Technical Steering Committee's 2025 decision to stop bundling Corepack with Node.js 25+ sent developers searching the web for a standalone Corepack installer, and the threat actor registered/repurposed corepack.org to rank for and capture that search traffic. The site itself shows hallmarks of AI-generated, low-effort content — a misspelled 'Downlaod' link in the header navigation, an FAQ section that confuses the Yarn JavaScript package manager with textile yarn crafting, and references to archives/resources that do not actually exist on the site — indicating largely automated content generation layered on top of a purpose-built malware delivery funnel.

Visitors who click through are routed to an OpenShield-branded landing page (hosted at openshield.canatrace[.]com/download-free-can/) that offers a 'free VPN client' download. The delivered binary (vpnsetup_d9gfqvs3dsic73fcvi90[.]exe) is not a VPN client but a combined infostealer/proxyware payload. On execution it: (1) accesses and exfiltrates browser-profile data (cookies, saved credentials, autofill, session tokens) and locally stored SSH private keys; (2) performs host and running-process discovery/enumeration; (3) can invoke PowerShell and native command-shell execution for follow-on actions; and (4) establishes persistence via a Windows Registry Run-key modification so it survives reboot. Independently of the credential-theft component, the payload silently enrolls the compromised host in a bandwidth-sharing / proxyware network, turning the machine into a proxy exit node that relays third-party (largely data-scraping) traffic without the victim's knowledge or consent — a technique known as proxyjacking, functionally and financially analogous to cryptojacking but monetizing bandwidth instead of CPU cycles.

A second, parallel infection path was identified on related pages in the same campaign cluster: a malvertising / affiliate-redirect chain running through go2cloud.org tracking subdomains (observed as nostop.go2cloud[.]org in this campaign) and additional redirector domains (freevpn[.]win/lps/gbox-lp/index.html, moonlighthathel[.]org, aifpleasurebeh[.]org, ghabovethec[.]info, ukankingwithea[.]com, beadpie[.]xyz, yakteam[.]xyz) ultimately serves a file named OperaGXSetup.exe. This is not the legitimate Opera GX browser installer but an adware/trojan payload disguised under the Opera GX brand, delivered by abusing affiliate/paid-acquisition redirect infrastructure of the kind go2cloud.org subdomains have repeatedly been observed facilitating in prior ad-hijacking campaigns (documented independently by Malwarebytes and MalwareTips against other go2cloud.org subnetworks).

The campaign specifically targets software developers — a high-value target segment with elevated local privileges, frequent SSH key usage for source-control and infrastructure access, and browsers holding credentials for cloud consoles, package registries, and CI/CD systems. Theft of SSH keys and browser session data from a developer workstation creates direct downstream supply-chain risk (e.g., unauthorized commits, package-registry publishes, or lateral movement into CI/CD and cloud environments) beyond the immediate host compromise.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Discovery

T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1090.003 Multi-hop Proxy

Initial Access

T1189 Drive-by Compromise

Impact

T1496 Resource Hijacking; T1496.002 Bandwidth Hijacking

Persistence

T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1552.004 Private Keys; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1584.001 Domains; T1587.001 Malware

Remediation for OpenShield Corepack VPN lure

Immediate actions

  • Block corepack.org, openshield.canatrace.com, freevpn.win, moonlighthathel.org, aifpleasurebeh.org, ghabovethec.info, ukankingwithea.com, beadpie.xyz, yakteam.xyz, and nostop.go2cloud.org at DNS/web-proxy/firewall layer
  • Search endpoint telemetry and download/proxy logs for vpnsetup_d9gfqvs3dsic73fcvi90.exe and OperaGXSetup.exe execution or download events
  • Audit Windows Registry Run/RunOnce keys on developer workstations for unauthorized entries added since the campaign's active window (2026)
  • Rotate/revoke any SSH keys and browser-stored credentials on hosts confirmed or suspected to have executed the payload
  • Hunt for unexpected outbound bandwidth-sharing/proxy-client processes and unusual sustained outbound connections consistent with proxyjacking activity

Workarounds

  • Instruct developers to install Corepack only via the official npm/Node.js documented method (`corepack enable` / official nodejs/corepack GitHub repo), never via a third-party corepack.org-style website

Longer-term hardening

  • Enforce software allow-listing / application control on developer endpoints to block unsigned or unrecognized VPN/utility installers
  • Deploy EDR with behavioral detection tuned to browser-credential-store access, SSH key file access, and PowerShell/cmd spawned by recently-downloaded executables
  • Educate developers to verify the official Corepack documentation and installation source (nodejs/corepack GitHub repository) rather than searching generically for 'corepack.org'
  • Implement DNS filtering / secure web gateway categorization for newly-registered and typosquat-adjacent domains impersonating developer tooling

Affected and fixed versions

  • N/A (typosquat/impersonation site) — corepack.org (fake site impersonating Node.js Corepack)
    Vulnerable versions: all visitors of the fake site
  • Microsoft — Windows (target OS for delivered .exe payloads)
    Vulnerable versions: all supported Windows versions

Timeline of OpenShield Corepack VPN lure

  • Node.js Technical Steering Committee announces it will stop bundling Corepack with Node.js 25+, prompting developers to seek standalone Corepack installation sources.
  • The fake locked-ioc-16 site is initially observed operating as a low-effort, AI-generated informational page before evolving into an active malware distribution funnel.
  • GitHub user MikeMcC399 opens issue #803 on nodejs/corepack warning the community that locked-ioc-16 is a fake, malicious site and should not be accessed.
  • A parallel malvertising/affiliate-redirect chain through locked-ioc-17 and related redirector domains is observed serving the locked-ioc-14 adware/trojan to the same visitor pool.
  • locked-ioc-16 begins actively directing visitors to the locked-ioc-21 landing page (locked-ioc-21.locked-ioc-15) serving the locked-ioc-7 infostealer/proxyware payload.
  • Researchers document a locked-ioc-1 inserted into the malvertising/affiliate redirect path immediately before the locked-ioc-14 payload is served.
  • Socket researchers confirm locked-ioc-16 ranks as the second organic result for the search query 'corepack' on the DuckDuckGo search engine, demonstrating the SEO-poisoning mechanism the campaign relies on to capture developer search traffic.
  • TL-Intel-Harness ingests the Socket.dev blog post via the RSS hunt pipeline and opens TL-2026-1676 to track the active campaign.
  • Socket Threat Research (Kirill Boychenko and Sarah Gooding) publishes detailed technical analysis of the fake locked-ioc-16 campaign, the locked-ioc-21 infostealer/proxyware payload, and the locked-ioc-14 malvertising chain.

Sources cited for OpenShield Corepack VPN lure

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats