# Fake Corepack.org Site Distributes OpenShield Infostealer/Proxyware to Developers; Secondary Malvertising Chain Delivers OperaGXSetup.exe Adware

> A malicious site impersonating the legitimate corepack.org domain lures developers searching for Node.js's standalone Corepack tool (after its removal from Node.js 25+) into downloading an OpenShield-branded 'free VPN client' installer that is actually an infostealer/proxyware combo. The infostealer harvests browser-profile data and SSH keys and can execute PowerShell/shell commands, while the proxyware silently enrolls the victim machine as a bandwidth-sharing proxy exit node for third-party data-scraping traffic (proxyjacking). A parallel malvertising/affiliate-redirect chain (go2cloud.org tracking infrastructure) pushes a trojanized OperaGXSetup.exe adware/PUP payload to the same visitors.

- **Published:** 2026-07-24T00:00:00Z
- **Last reviewed:** 2026-07-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1676
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-openshield-corepack-vpn-lure-tl-2026-1676.webp?v=12e6b989 (Threadlinqs threat intel: OpenShield Corepack Lure Adds Proxyware: Detection & IOCs (TL-2026-1676) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-1676
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

In March 2026 the Node.js `corepack` GitHub repository (issue #803) flagged https://corepack.org as a fake, malicious impersonation of the project's official documentation presence, warning users not to access it. Socket's Threat Research team (Kirill Boychenko and Sarah Gooding) subsequently analyzed the site and published findings on 2026-07-24 showing it had evolved from a low-effort informational page into an active malware distribution vector.

The campaign directly exploits a supply-chain-adjacent trust gap: the Node.js Technical Steering Committee's 2025 decision to stop bundling Corepack with Node.js 25+ sent developers searching the web for a standalone Corepack installer, and the threat actor registered/repurposed corepack.org to rank for and capture that search traffic. The site itself shows hallmarks of AI-generated, low-effort content — a misspelled 'Downlaod' link in the header navigation, an FAQ section that confuses the Yarn JavaScript package manager with textile yarn crafting, and references to archives/resources that do not actually exist on the site — indicating largely automated content generation layered on top of a purpose-built malware delivery funnel.

Visitors who click through are routed to an OpenShield-branded landing page (hosted at openshield.canatrace[.]com/download-free-can/) that offers a 'free VPN client' download. The delivered binary (vpnsetup_d9gfqvs3dsic73fcvi90[.]exe) is not a VPN client but a combined infostealer/proxyware payload. On execution it: (1) accesses and exfiltrates browser-profile data (cookies, saved credentials, autofill, session tokens) and locally stored SSH private keys; (2) performs host and running-process discovery/enumeration; (3) can invoke PowerShell and native command-shell execution for follow-on actions; and (4) establishes persistence via a Windows Registry Run-key modification so it survives reboot. Independently of the credential-theft component, the payload silently enrolls the compromised host in a bandwidth-sharing / proxyware network, turning the machine into a proxy exit node that relays third-party (largely data-scraping) traffic without the victim's knowledge or consent — a technique known as proxyjacking, functionally and financially analogous to cryptojacking but monetizing bandwidth instead of CPU cycles.

A second, parallel infection path was identified on related pages in the same campaign cluster: a malvertising / affiliate-redirect chain running through go2cloud.org tracking subdomains (observed as nostop.go2cloud[.]org in this campaign) and additional redirector domains (freevpn[.]win/lps/gbox-lp/index.html, moonlighthathel[.]org, aifpleasurebeh[.]org, ghabovethec[.]info, ukankingwithea[.]com, beadpie[.]xyz, yakteam[.]xyz) ultimately serves a file named OperaGXSetup.exe. This is not the legitimate Opera GX browser installer but an adware/trojan payload disguised under the Opera GX brand, delivered by abusing affiliate/paid-acquisition redirect infrastructure of the kind go2cloud.org subdomains have repeatedly been observed facilitating in prior ad-hijacking campaigns (documented independently by Malwarebytes and MalwareTips against other go2cloud.org subnetworks).

The campaign specifically targets software developers — a high-value target segment with elevated local privileges, frequent SSH key usage for source-control and infrastructure access, and browsers holding credentials for cloud consoles, package registries, and CI/CD systems. Theft of SSH keys and browser session data from a developer workstation creates direct downstream supply-chain risk (e.g., unauthorized commits, package-registry publishes, or lateral movement into CI/CD and cloud environments) beyond the immediate host compromise.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1583.001 Domains
- T1584.001 Domains
- T1587.001 Malware
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1082 System Information Discovery
- T1057 Process Discovery
- T1016 System Network Configuration Discovery
- T1555.003 Credentials from Web Browsers
- T1552.004 Private Keys
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1090.003 Multi-hop Proxy
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1496.002 Bandwidth Hijacking
- T1036.005 Match Legitimate Resource Name or Location

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake VPN/Corepack Installer Download and Execution from Typosquat Domain** (`TL-2026-1676-SPL-001`)

Detects download and first execution of the 'vpnsetup' or 'OperaGXSetup' branded installers sourced from the fake corepack.org / openshield.canatrace.com / go2cloud.org malvertising chain, catching the initial drive-by/user-execution stage of the OpenShield infostealer/proxyware campaign.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1189, T1204.002, T1036.005
- **Data sources:** proxy, pan:threat, stream:http, sysmon
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="pan:threat" OR sourcetype="stream:http"
| eval domain=coalesce(dest_hostname, url_domain, http_host)
| search domain IN ("corepack.org","*.canatrace.com","openshield.canatrace.com","freevpn.win","moonlighthathel.org","aifpleasurebeh.org","ghabovethec.info","ukankingwithea.com","beadpie.xyz","yakteam.xyz","*.go2cloud.org")
| join type=left dest_ip [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*vpnsetup*.exe" OR TargetFilename="*OperaGXSetup.exe") | rename Computer as dest_ip ]
| stats earliest(_time) as first_seen latest(_time) as last_seen count by domain, TargetFilename, dest_ip, user
| where isnotnull(TargetFilename)
| sort - last_seen
```

### Microsoft KQL

```kql
let badDomains = dynamic(["corepack.org","canatrace.com","openshield.canatrace.com","freevpn.win","moonlighthathel.org","aifpleasurebeh.org","ghabovethec.info","ukankingwithea.com","beadpie.xyz","yakteam.xyz","go2cloud.org"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (badDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName endswith "vpnsetup.exe" or FileName has "vpnsetup" or FileName =~ "OperaGXSetup.exe"
    | project FileCreateTimestamp = Timestamp, DeviceName, FileName, FolderPath, SHA256
) on DeviceName
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, FileName, FolderPath, SHA256
```

### Sigma

```yaml
title: Fake Corepack/OpenShield VPN Installer Downloaded From Known Malicious Domain
id: 3a9d4d1e-4c8a-4d2a-9f7e-1a2b3c4d5e6f
status: experimental
description: Detects network connections to the fake corepack.org / OpenShield / go2cloud.org malvertising infrastructure immediately followed by creation of a vpnsetup*.exe or OperaGXSetup.exe file, indicating the initial drive-by download stage of the OpenShield infostealer/proxyware campaign.
references:
    - https://socket.dev/blog/fake-corepack-site-distributes-infostealer-and-proxyware
    - https://github.com/nodejs/corepack/issues/803
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/24
tags:
    - attack.initial-access
    - attack.t1189
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: file_event
    product: windows
detection:
    selection_domain:
        Initiated: 'true'
    selection_file:
        TargetFilename|contains:
            - 'vpnsetup'
            - 'OperaGXSetup.exe'
        TargetFilename|endswith: '.exe'
    condition: selection_file
falsepositives:
    - Legitimate Opera GX browser installer downloaded from opera.com (verify SHA256 and referrer domain before alerting)
level: high
```

**Known false positives:**

- Legitimate Opera GX installer downloaded directly from opera.com rather than the go2cloud.org redirect chain

**Tuning notes:** Keep the domain watchlist updated as new redirector domains for this campaign are identified; correlate with proxy referrer chains showing 3+ hops ending in an .exe download.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PowerShell Child Process Spawned by Recently Downloaded VPN/Utility Installer (locked: unlock with TL Creds)
- Browser Credential Store and SSH Key Directory Access by Recently Downloaded Installer (locked: unlock with TL Creds)
- Registry Run Key Persistence Added by Fake VPN/OperaGX Installer (locked: unlock with TL Creds)
- Host and Network Discovery Sweep Following Fake VPN Installer Execution (locked: unlock with TL Creds)
- Collected Data Archived by Recently Downloaded Installer Prior to Exfiltration (locked: unlock with TL Creds)
- Sustained Low-and-Slow Outbound Connections Consistent With Proxyware Bandwidth-Hijacking Beacon (locked: unlock with TL Creds)
- SEO-Poisoned Corepack Search Result Click-Through to Malware Landing Page (locked: unlock with TL Creds)
- Deceptive 'Your File Download Is Ready' Interstitial Preceding Adware Executable Delivery (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- Domain: `corepack[.]org`
- Domain: `canatrace[.]com`
- Domain: `freevpn[.]win`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake Corepack Site Distributes Infostealer and Proxyware](https://socket.dev/blog/fake-corepack-site-distributes-infostealer-and-proxyware?utm_medium=feed)
- [Fake https://corepack.org site · Issue #803 · nodejs/corepack](https://github.com/nodejs/corepack/issues/803)
- [go2cloud.org - Malwarebytes Threat Alert](https://www.malwarebytes.com/blog/detections/go2cloud-org)
- [Remove Appfocus.go2cloud.org Redirect (Virus Removal Guide)](https://malwaretips.com/blogs/remove-appfocus-go2cloud-org/)
- [Go2cloud.org and subnetworks in affiliate ad-hijacking](https://www.multiplicit.co.uk/go2cloud-org-and-subnetworks-in-affiliate-ad-hijacking/)
- [Is Opera GX Safe? Official Browser vs Fake Installer Risks](https://blog.gridinsoft.com/opera-gx-is-safe/)
- [Proxyjacking has Entered the Chat](https://www.sysdig.com/blog/proxyjacking-attackers-log4j-exploited)
- [New proxyjacking attacks monetize hacked SSH servers' bandwidth](https://www.bleepingcomputer.com/news/security/new-proxyjacking-attacks-monetize-hacked-ssh-servers-bandwidth/)
- [Bandwidth Hijacking (T1496.002) | MITRE ATT&CK](https://www.startupdefense.io/mitre-attack-techniques/t1496-002-bandwidth-hijacking)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1676