MITRE Techniques

• [T1098 ] Account Manipulation – The operators compromise developer accounts and use them to insert malicious changes into repositories, extending access over time (‘compromised developer accounts’).
• [T1036 ] Masquerading – Malicious JavaScript is hidden in configuration files or disguised as .woff2 fonts to avoid inspection (‘files presented as .woff2 fonts’).
• [T1059.007 ] Command and Scripting Interpreter: JavaScript – The infection chain uses JavaScript as the payload language and later-stage malicious content (‘Malicious JavaScript is hidden’).
• [T1106 ] Native API – The PHP entry point executes the infection chain via shell_exec, launching commands from the application (‘executed through PHP’s shell_exec function’).
• [T1105 ] Ingress Tool Transfer – The initial code resolves C2 infrastructure and downloads later-stage infostealer payloads from remote servers (‘it then downloads later-stage infostealer payloads’).
• [T1027 ] Obfuscated Files or Information – The JavaScript payload is heavily obfuscated and concealed in repository files (‘heavily obfuscated JavaScript’).
• [T1195.002 ] Supply Chain Compromise: Compromise Software Supply Chain – The attackers plant malicious source in repositories and later let package resolution expose it through ecosystems like Packagist and Go modules (‘package-registry compromise is often a consequence’).
• [T1566 ] Phishing – No direct phishing is described; not applicable from the article content.
• [T1078 ] Valid Accounts – Compromised developer identities are used to access repositories and private projects (‘through compromised developer accounts’).
• [T1105 ] Ingress Tool Transfer – Staged delivery fetches payloads after resolving C2 via dead-drop mechanisms (‘using techniques including EtherHiding and, more recently, NullReceiver’).