operni@1.2.7

Analysis

The sole file reps/template.min.js builds a two-stage phishing page: Stage 1 is a "Micro-Share secure file sharing" page claiming documents from "[account]"; Stage 2 is a Microsoft-branded sign-in form that prompts for email/credentials. On form submit, it redirects the victim to login[.]siemens-energy[.]icu (a typosquatted Siemens Energy domain). The code includes bot-detection (navigator.webdriver, user-agent checks, honeypot fields) and anti-copy protections. No lifecycle hooks, no Node.