jQuery Migrate Library Silently Compromised to Steal Logins Using Parrot Traffic Direction System

A sophisticated supply chain attack has emerged that weaponizes the trusted jQuery Migrate library to deliver stealthy malware capable of harvesting user credentials and session data.

Security researchers discovered this campaign after investigating unusual online behavior from a senior executive who accessed a seemingly legitimate Middle Eastern business website, which subsequently triggered the silent delivery of a corrupted JavaScript file masquerading as the official jquery-migrate-3.4.1.min.js library.

The attack begins when victims visit compromised WordPress websites that have been infected with the Parrot Traffic Direction System (TDS), a sophisticated toolkit used by cybercriminals to selectively filter and redirect traffic based on device characteristics, browser types, and geographic locations.

In this specific incident, the initial infection vector was traced to a compromised autoptimize cache file hosted at hxxps://tabukchamber[.]sa/wp-content/cache/autoptimize/js/autoptimize_979aed35e1d8b90442a7373c2ef98a82[.]js, which contained embedded Parrot TDS logic designed to fingerprint legitimate users before serving malicious payloads.

Trellix analysts identified that the malicious jQuery Migrate file appeared legitimate on initial inspection but contained a sizable obfuscated JavaScript payload appended after thousands of lines of authentic library code.

This strategic placement makes the malware extremely difficult to detect through casual inspection or automated static analysis tools, as the malicious code is hidden after the standard jQuery Migrate functionality that developers expect to see.

Infection Mechanism and Payload Delivery

The compromised jQuery Migrate library employs a four-stage infection mechanism that demonstrates remarkable sophistication in evading detection.

The malware initializes with an obfuscated string builder that dynamically reconstructs critical JavaScript functions and URLs from fragmented arrays, effectively masking suspicious keywords like “eval,” “XMLHttpRequest,” and domain fragments from static scanners.

Following string reconstruction, the malware creates a custom HTTP wrapper around XMLHttpRequest to avoid easily traced network communication methods like jQuery’s standard ajax() functions.

The system then generates unique randomized tokens for each session using the logic, which helps bypass caching mechanisms and makes network requests appear legitimate while avoiding signature-based detection.

The final stage involves remote code execution where the malware sends GET requests to attacker-controlled domains using the generated tokens as query parameters, with responses containing additional JavaScript payloads executed via eval() functions.

This architecture enables attackers to dynamically modify their payload capabilities based on victim circumstances, allowing for credential theft, session hijacking, keystroke logging, and deployment of fake authentication interfaces without leaving substantial disk artifacts.

Power up early threat detection, escalation, and mitigation with ANY.RUN’s Threat Intelligence Lookup. Get 50 trial searches.