'Noblox.js' NPM Malware Targets Roblox Players
Cybercriminals often exploit innovative methods to deliver their payloads to victims. In recent years, many of them have tried abusing fake NPM packages to achieve this. But before we go into more details, let's explain what the NPM platform is. This is the primary package manager for the JavaScript runtime environment known as Node.JS. Developers all around the world use the npm platform to publish, share, and access pre-made JavaScript packages that could fulfill all sorts of tasks. Although all uploads go through a vetting process, it is possible for cybercriminals to bypass these checks, and upload malicious JavaScript code onto the platform. This is exactly what the creators of the 'Noblox.js' NPM Malware have done.
A similar NPM attack was carried in the spring of 2021 when the malicious 'web-browserify' malware mimicked a legit NPM package. The 'Noblox.js' NPM Malware works in the same manner, and the payload it delivers can carry out a wide range of tasks. It appears that the primary focus of the attackers is stealing files and credentials, as well as running ransomware on the compromised machine.
It is important to add that the 'Noblox.js' is also a legitimate project – the criminals are copying its name to deceit users.
How is the 'Noblox.js' NPM Malware Delivered?
Since the malware appears to target Roblox users, it only makes sense that its creators are using online Roblox communities to spread the malware. To make their offer seem more legitimate, they may often offer prizes such as cash or Robux, the in-game currency in the Roblox game. One of the scams promises to award all users who run a Roblox bot for a month. The instructions to run the bot involve downloading and installing the 'Noblox.js' NPM Malware.
After the attack is complete, victims might be infected with a MBR-locking ransomware, which will prevent them from booting their computer. The crooks behind the 'Noblox.js' NPM Malware demand a ransom payment in exchange for unlocking the victim's device. Currently, it is not advised to pay – seeking alternative recovery solutions is the best course of actions.
