The cybersecurity landscape witnessed a concerning development as threat actors discovered a novel attack vector targeting Microsoft Edge’s Internet Explorer mode functionality.

This sophisticated campaign emerged in August 2025, exploiting the inherent security weaknesses of legacy browser technology to compromise unsuspecting users’ devices.

The attack represents a significant evolution in threat actor tactics, demonstrating their ability to weaponize seemingly benign compatibility features.

The attack methodology combines social engineering with zero-day exploits targeting Internet Explorer’s Chakra JavaScript engine. Cybercriminals initially direct victims to carefully crafted spoofed websites that appear legitimate, creating a false sense of security.

Once victims arrive at these malicious sites, attackers deploy a strategic flyout notification requesting users to reload the page in Internet Explorer mode, effectively transitioning them from Edge’s secure Chromium-based environment to IE’s vulnerable legacy framework.

This transition proves critical as Internet Explorer lacks the robust security architecture and defense-in-depth mitigations present in modern browsers.

The legacy environment exposes users to risks that contemporary Chromium-based browsers are specifically engineered to prevent, creating an ideal exploitation opportunity for malicious actors.

Microsoft Edge security analysts identified the threat after receiving credible intelligence about active exploitation campaigns.

The research team discovered that attackers were systematically targeting the compatibility feature designed to support legacy business applications, older security camera interfaces, and government portals that still rely on outdated technologies like ActiveX and Flash.

Chakra Engine Exploitation and Privilege Escalation

The attack’s technical sophistication lies in its multi-stage exploitation process targeting the Chakra JavaScript engine.

After successfully convincing victims to switch to Internet Explorer mode, attackers deploy unpatched zero-day exploits specifically crafted for IE’s JavaScript execution environment.

The Chakra engine, despite Microsoft’s previous hardening efforts, remains vulnerable to memory corruption attacks that enable remote code execution.

Following successful code execution within the browser context, threat actors implement a second exploit designed for privilege escalation.

This secondary payload allows attackers to break out of the browser’s sandboxed environment, gaining elevated system privileges and full device control.

The dual-exploit approach ensures comprehensive system compromise, enabling malware installation, lateral movement within corporate networks, and sensitive data exfiltration.

Microsoft responded by restricting IE mode access, removing high-risk entry points including toolbar buttons and context menus while maintaining enterprise policy support for legitimate business needs.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Leveraging Microsoft Edge Internet Explorer Mode to Gain Access to Users’ Devices appeared first on Cyber Security News.

North Korean state-sponsored threat actors have intensified their supply chain attacks against software developers through a sophisticated campaign dubbed “Contagious Interview,” deploying 338 malicious npm packages that have accumulated over 50,000 downloads.

The operation represents a dramatic escalation in the weaponization of the npm registry, targeting Web3, cryptocurrency, and blockchain developers through elaborate social engineering schemes disguised as legitimate job recruitment processes.

The campaign operates on a multi-stage attack framework that begins with reconnaissance on professional platforms like LinkedIn.

Threat actors pose as recruiters or hiring managers, screening potential victims for technical expertise and financial opportunity.

They specifically target developers working with cryptocurrency wallets, blockchain infrastructure, and Web3 applications, seeking to compromise systems likely to contain valuable credentials, private keys, and monetizable secrets.

Socket.dev analysts identified the malware following reports from victims who received fraudulent job opportunities that included coding assignments containing malicious dependencies.

The researchers discovered that threat actors have evolved their tooling from direct BeaverTail malware droppers to more sophisticated HexEval, XORIndex, and encrypted loaders that execute during package installation or import processes.

The malicious packages employ typosquatting techniques targeting everyday dependencies that developers install routinely, particularly in Node.js environments.

Examples include variations of popular packages such as epxreso/epxresso/epxressoo (Express), dotevn (dotenv), and boby_parser (body-parser).

This strategy exploits the deadline pressure common in technical interviews where candidates execute “npm install” commands without thorough scrutiny.

Advanced Encryption and Persistence Mechanisms

The latest wave introduces encrypted loaders that demonstrate a significant evolution in the attackers’ technical capabilities.

These loaders utilize Node.js crypto functions with hardcoded AES-256-CBC encryption keys and initialization vectors, storing encrypted payloads in seemingly innocuous files like LICENSE documents.

The malware reconstructs obfuscated BeaverTail malware in memory before typically fetching the InvisibleFerret backdoor for persistent system access.

The encrypted loader implementation splits decryption logic across multiple files within the same package.

Analysis of the redux-saga-sentinel package reveals how the loader imports Node crypto in lib/utils/smtp-connection/parse.js while storing the encrypted payload in the LICENSE file.

During runtime, the loader decrypts the hex ciphertext to recover stage-two JavaScript code, which maintains obfuscation to evade static analysis detection.

This technique enables in-memory execution while avoiding disk-based artifacts that traditional security tools might detect.

The recovered payload establishes command and control communication over HTTP/HTTPS protocols, often using legitimate hosting platforms like Vercel to blend into normal developer traffic patterns, making detection significantly more challenging for security teams monitoring network communications.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post North Korean Hackers Attacking Developers with 338 Malicious npm Packages appeared first on Cyber Security News.