Burrowing into the Beamglea Campaign DNS Infrastructure

Recently, researchers uncovered 175 malicious npm packages related to the widespread Beamglea phishing campaign. The threat actors targeted more than 135 industrial, technology, and energy companies worldwide. In addition, as of 9 October 2025, the packages have been downloaded more than 26,000 times.

Sixteen indicators of compromise (IoCs) comprising four subdomains, three domains, and nine email addresses were identified. We dove deeper into them. Our analysis revealed these findings:

• Two of the domains identified as IoCs were dubbed likely to turn malicious 176–219 days before they were reported as such
• 344 email-connected domains
• Five IP addresses, three were malicious
• 18 IP-connected domains
• Three string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://socket.dev/blog/175-malicious-npm-packages-host-phishing-infrastructure