The newest Supply Chain Security resources are on the Supply Chain Security page. For a reading order instead of a date order, see the Supply Chain Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-05-15 2026 | Stealer Backdoor Found in 3 Node-IPC Versions Targeting Developer Secrets news 4 min read | Library: node-ipc versions 9.1.6, 9.2.3, and 12.0.1 contain a stealer backdoor that fingerprints hosts, enumerates local files, and exfiltrates developer and cloud secrets including AWS, Google Cloud, Azure, SSH keys, Kubernetes tokens, and GitHub CLI configs to sh.azurestaticprovider[.]net. The malware uses an Immediately Invoked Function Expression (IIFE) and a SHA-256 fingerprint check for conditional execution, and can exfiltrate data via DNS TXT records by overriding the system's DNS resolver. → thehackernews.com |
| 2026-05-15 2026 | OpenAI says no user data compromised after supply-chain attack news | OpenAI has confirmed that no user data was compromised following a recent supply-chain attack. The incident involved a malicious actor gaining access to a third-party vendor's tools, which in turn had access to OpenAI's systems. While the attackers could view certain customer information, including names, emails, and payment details of some users, OpenAI states that no sensitive data like passwords or full credit card numbers were accessed. The company has since revoked the vendor's access and is working to prevent similar incidents in the future. → cybernews.com |
| 2026-05-14 2026 | OpenAI Tells Mac Users to Update Apps After Software Supply Chain Attack news 4 min read | Library update for OpenAI macOS users following a software supply chain attack via malicious Tanstack npm packages. The attack, attributed to TeamPCP, leveraged three chained vulnerabilities to distribute credential-stealing malware. OpenAI's investigation found employee devices installed affected versions, leading to compromised internal source code repositories containing signing certificates. As a precaution, OpenAI is rotating code-signing certificates, necessitating updates for macOS applications to prevent potential distribution of fake OpenAI products. |
| 2026-05-14 2026 | Active Supply Chain Attack: Malicious node-ipc Versions Published to npm news 17 min read | Tool detailing the node-ipc supply chain attack where malicious versions 9.1.6, 9.2.3, and 12.0.1 were published to npm. The attack, executed by a rogue maintainer, injected an obfuscated payload into the CommonJS bundle designed to steal over 90 categories of credentials and exfiltrate them to an attacker-controlled server. Version 12.0.1 includes a specific targeting gate based on the module's file path hash. → stepsecurity.io |
| 2026-05-14 2026 | OpenAI asks macOS users to update after TanStack npm supply chain attack news 4 min read | Library for securing applications against supply chain attacks, exemplified by the TanStack npm compromise. This incident involved credential stealers and self-propagation targeting popular npm, PyPI, and other packages, impacting companies like OpenAI and Mistral AI. The attack, attributed to TeamPCP, highlights the risks associated with interconnected software ecosystems and the need for rigorous security controls to validate legitimate software and prevent unauthorized modifications. |
| 2026-05-14 2026 | OpenAI confirms security breach in TanStack supply chain attack news 3 min read | Library impacting hundreds of npm and PyPI packages, the TanStack supply chain attack, also known as Mini Shai-Hulud, led to OpenAI confirming a breach on two employee devices. While no customer data or production systems were compromised, attackers exfiltrated limited credentials from internal repositories, prompting OpenAI to rotate code-signing certificates for its applications. The campaign utilized compromised GitHub Actions workflows and CI/CD configurations to inject malicious code and publish trojanized package versions, targeting developer and cloud credentials, including GitHub tokens and AWS credentials, and establishing persistence via modified code hooks. → bleepingcomputer.com |
| 2026-05-14 2026 | OpenAI denies user data exposure from TanStack npm Mini Shai-Hulud supply chain attack news 3 min read | Library of malicious packages, including those affecting TanStack npm and targeting OpenAI devices, comprised the "Mini Shai-Hulud" campaign. This supply chain attack exploited GitHub Actions to distribute 84 malicious versions across 42 TanStack libraries, aiming to steal credentials like GitHub tokens and cloud keys. While OpenAI confirmed two employee devices were compromised, they found no evidence of user data exposure or intellectual property theft, though some credential material was accessed. |
| 2026-05-14 2026 | AI-driven supply chain attacks expose shift in cyber threat model Beazley warns news | Analysis of AI-driven supply chain attacks highlights a new cyber threat model where attackers exploit trusted software and automation systems, moving beyond malware to focus on credential compromise and workflow exploitation. This shift, detailed by Beazley, signifies an evolving attacker methodology. Access to the full analysis requires a paid subscription or a free trial. |
| 2026-05-14 2026 | Inside a Tor Backed Supply Chain Worm news 9 min read | Library for detecting sophisticated npm supply chain attacks, featuring the `crypto-javascri` package that mimics `crypto-js`. This malicious package harvests npm and GitHub credentials, hijacks maintainer accounts to republish trojanized packages, and deploys a Tor-based command-and-control implant. The worm targets Linux developer systems and CI/CD environments, propagating by injecting itself into legitimate packages and updating their versions. → cloudsek.com |
| 2026-05-14 2026 | Mistral AI allegedly breached by Dune-loving criminals following TanStack supply chain hit 450 repositories exposed news | Mistral AI is reportedly the latest victim of a cyberattack following the recent TanStack supply chain incident. Threat actors, described as "Dune-loving criminals," are alleged to have breached Mistral AI, exposing 450 of its repositories. This attack highlights a growing trend of supply chain compromises targeting prominent tech companies. → cybernews.com |
| 2026-05-14 2026 | OpenAI Confirms No User Data Stolen in TanStack Supply-Chain Attack news | OpenAI has confirmed that no user data was compromised during a recent supply-chain attack targeting TanStack. The attack involved malicious code being injected into the `tanstack-query` package, a popular JavaScript library. While the code was designed to steal user data, OpenAI's security measures effectively detected and prevented any data exfiltration. The company emphasizes that its users' information remains secure. |
| 2026-05-14 2026 | Analyzing TeamPCPs Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft news 17 min read | Library analyzing TeamPCP's supply chain attacks, specifically the Checkmarx KICS and elementary-data incidents. The campaign leverages CI/CD and release workflows to steal credentials like GitHub PATs, npm tokens, and cloud secrets. Techniques include multichannel poisoning across Docker Hub, VS Code extensions, and GitHub Actions, as well as GitHub Actions script injection to produce malicious packages signed by legitimate CI, targeting ecosystems like PyPI and GHCR. → trendmicro.com |
| 2026-05-14 2026 | Shai-Hulud Malware Exposes Future Supply Chain Risks news | Shai-Hulud is a newly discovered malware that poses significant future supply chain risks. It's designed to target development environments and compromise the software supply chain. The malware operates stealthily, aiming to inject malicious code into software projects before they are distributed. This could lead to widespread infections of end-user systems. Researchers have identified Shai-Hulud as a sophisticated threat requiring immediate attention to mitigate its potential impact on software integrity and security. |
| 2026-05-14 2026 | OpenAI says two employee devices hit by TanStack malware attack but no user data breached news | OpenAI reported a malware attack affecting two employee devices due to a compromised dependency, TanStack. The company stated that no user data was accessed or breached as a result of the incident. The attackers gained access to employee tools, but OpenAI confirmed their systems have been secured and a thorough investigation is underway. → cybernews.com |
| 2026-05-14 2026 | OpenAI says no user data stolen after supply-chain hackers accessed employee devices news 2 min read | Writeup detailing a supply-chain attack impacting OpenAI via the TanStack npm library. Attackers exploited GitHub Actions and CI/CD cache weaknesses to publish malicious package versions designed to exfiltrate developer credentials like GitHub tokens and API keys. While OpenAI reported unauthorized access and limited credential exfiltration from two employee devices, they found no evidence of user data, production systems, or intellectual property compromise. This incident highlights renewed concerns about open-source software security, particularly within the npm ecosystem. |
| 2026-05-14 2026 | Worm Redux: Fresh Mini Shai-Hulud Infections Bite Supply Chain news | A new worm, dubbed "Mini Shai-Hulud" by researchers, is actively infecting the software supply chain. This malware targets developers, aiming to compromise their development environments and potentially inject malicious code into legitimate software projects. The worm's propagation methods and specific targets are still under investigation, but its presence signifies a growing threat to the integrity of software development and distribution. Organizations are advised to enhance their security protocols and vigilance against such supply chain attacks. → darkreading.com |
| 2026-05-13 2026 | Mass Supply-Chain Attack Slams npm and PyPi Hits Mistral AI news 5 min read | Library for securing supply chains against the "Mini Shai-Hulud" worm, which has targeted npm and PyPI packages, including those from Mistral AI. This worm autonomously spreads by stealing credentials from over 100 locations, including cloud platforms and developer tools, and can include a wiper payload. Recommendations include implementing code cooldown periods before integrating new packages, enforcing multifactor authentication, and routine key rotation to mitigate these attacks. → bankinfosecurity.com |
| 2026-05-13 2026 | Mass Supply-Chain Attack Slams npm and PyPi Hits Mistral AI news 5 min read | Library for detecting and defending against supply-chain attacks, exemplified by the Mini Shai-Hulud worm that targeted npm and PyPI packages, including those from Mistral AI and TanStack. This malware family, known for credential stealing and wiper capabilities, spreads autonomously by compromising publish tokens and includes country-aware logic. Defense strategies include implementing code cooldown periods before package integration and enforcing multifactor authentication across developer accounts. → govinfosecurity.com |
| 2026-05-13 2026 | Risky Bulletin: RubyGems disables sign-ups after attack on staff news 13 min read | Newsletter summarizing recent application security incidents, including the RubyGems supply chain attack involving malicious packages targeting developers, the TanStack framework's compromise affecting hundreds of npm libraries with a self-propagating worm, and Skoda's web store vulnerability exposing customer data. It also touches on the Nitrogen ransomware group claiming responsibility for a Foxconn hack, West Pharmaceutical experiencing a ransomware attack, and Vodafone source code leaks by Lapsus$. |
| 2026-05-12 2026 | Mini Shai-Hulud malware compromises hundreds of open-source packages in sprawling supply-chain attack news 4 min read | Library for detecting credential-stealing malware like "mini Shai-Hulud" that compromises open-source packages including TanStack and UiPath. This malware exploits automated software publishing, bypassing two-factor authentication and using cryptographically valid signatures. It targets cloud infrastructure like AWS, Google Cloud, and Kubernetes, stealing security keys and passwords via obfuscated payloads disguised as initialization modules. The campaign uses Bun for exfiltration via anonymous messaging and embeds itself in developer tools such as VS Code and Anthropic's Claude Code, highlighting vulnerabilities in CI/CD pipelines and developer tooling directories. → cyberscoop.com |
| 2026-05-12 2026 | Mistral AI SDK TanStack Router hit in npm software supply chain attack news 3 min read | Writeup of a software supply chain attack targeting numerous npm and PyPI packages, including Mistral AI's SDK and the TanStack Router ecosystem. The TeamPCP threat group exploited GitHub Actions weaknesses and maintainer misconfigurations, leveraging the Mini Shai-Hulud malware to steal developer credentials and install a destructive 'dead man's switch' component. The attack highlights vulnerabilities in implicit trust within software usage networks and affects hundreds of packages, potentially compromising enterprise credentials. → csoonline.com |
| 2026-05-12 2026 | Shai-Hulud Here We Go Again: 170 Packages Hit Across npm & PyPi news 4 min read | Library for detecting and mitigating the "Shai-Hulud: Here We Go Again" malware, which targets npm and PyPi. This self-propagating credential-stealing malware has affected over 170 packages, including those from Mistral AI, OpenSearch Project, and TanStack, impacting hundreds of millions of downloads. The variant includes token monitoring and a machine wipe function triggered upon token revocation, and exfiltrates stolen credentials to GitHub repositories. Immediate actions recommended include rotating keys, enabling 2FA, and downgrading affected packages. → ox.security |
| 2026-05-12 2026 | TanStack npm Packages Hit by Mini Shai-Hulud news 12 min read | Library compromised by the Mini Shai-Hulud supply chain attack impacting @tanstack npm packages, leading to the publication of 84 malicious artifacts. This incident, attributed to TeamPCP, marks the first documented case of malicious npm packages possessing valid SLSA provenance, achieved by hijacking the legitimate release pipeline via a `pull_request_target` vulnerability, cache poisoning, and OIDC token extraction. Affected packages include `@tanstack/react-router`, with remediation involving treating affected install environments as compromised and rotating secrets. → snyk.io |
| 2026-05-12 2026 | RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded news | Writeup detailing the recent suspension of new signups by RubyGems, the Ruby programming language's standard package manager, due to a "major malicious attack." Hundreds of malicious packages were uploaded, some containing exploits. This incident highlights the rising threat of software supply chain attacks against open-source ecosystems, with threat actors like TeamPCP compromising popular packages to distribute credential-stealing malware. Mend.io, securing RubyGems, intends to release further details once the incident is contained. → thehackernews.com |
| 2026-05-12 2026 | SailPoint Discloses GitHub Repository Hack news 1 min read | Writeup of SailPoint's GitHub repository hack, occurring April 20th, resulted from a third-party application vulnerability. SailPoint contained the incident swiftly, with a cybersecurity firm's investigation finding no evidence of production or staging data compromise or service interruption. Affected customers in the accessed repositories were notified, with no further action currently required. The specific vulnerability and threat actor remain undisclosed, with no confirmed link to TeamPCP. → securityweek.com |
| 2026-05-12 2026 | TanStack Mistral AI UiPath Hit in Fresh Supply Chain Attack news 5 min read | Library that authors of the Mini Shai-Hulud supply chain attack compromised to steal developer credentials, API keys, and secrets. The attack targeted over 170 packages across NPM and PyPI, including TanStack, Mistral AI, and UiPath. Attackers exploited vulnerabilities in GitHub Actions OIDC tokens and cache poisoning to publish malicious packages with forged SLSA provenance, making them appear legitimate. The malware harvested sensitive data through multiple exfiltration channels, including a decentralized Session network. → securityweek.com |
| 2026-05-12 2026 | Hundreds of open source packages hacked: Im just not gonna run npm install anymore news | Hundreds of open source packages hacked: “I’m just not gonna run npm install anymore” https://ift.tt/rDlQGUa → cybernews.com |
| 2026-05-12 2026 | Claude Code MCP Attack Enables Persistent Token Theft intermediate 4 min read | Analysis of a Claude Code MCP attack reveals a sophisticated MitM technique that abuses integrations to steal OAuth tokens, enabling persistent access to connected SaaS platforms. The attack leverages malicious npm postinstall hooks to silently rewrite the `~/.claude.json` configuration file, redirecting traffic through attacker-controlled proxies. This method is difficult to detect as compromised OAuth sessions appear legitimate in audit logs and token rotation alone is insufficient. Organizations should implement layered controls focusing on configuration monitoring, OAuth security, and software supply chain governance. → esecurityplanet.com |
| 2026-05-11 2026 | AI Is Reshaping Software Supply Chain Risk beginner 3 min read | Analysis of AI's impact on software supply chain security highlights expanding attack surfaces due to AI-assisted development, with 84% of developers using AI tools. Traditional security controls like EDR and MDM lack visibility into AI integrations, browser extensions, and package managers. This leads to increased risk from malicious open-source packages, with Aikido Intel identifying up to 100,000 daily. Organizations require real-time visibility and install-time controls for developer tooling, as compromised workstations grant attackers trusted access to repositories and credentials. → esecurityplanet.com |
| 2026-05-11 2026 | TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack news 1 min read | Writeup of TeamPCP's compromise of the Checkmarx Jenkins AST plugin, occurring weeks after their KICS supply chain attack. This incident highlights the exploitation of software supply chain trust and the potential for incomplete remediation, as evidenced by the defaced GitHub repository and malicious updates to the plugin. The ongoing attacks by TeamPCP underscore the persistent threat to developer tools and credentials. → thehackernews.com |
| 2026-05-11 2026 | Build Application Firewalls Aim to Stop the Next Supply Chain Attack beginner 4 min read | Library from InvisiRisk, a build application firewall (BAF), enforces policy during the CI/CD build process by inspecting package activity rather than solely scanning code. This approach aims to prevent supply chain attacks, such as those involving the SolarWinds breach or hijacked npm libraries like Axios, by detecting unexpected or malicious actions within the build environment. The BAF, along with InvisiRisk's TruSBOM tool, provides detailed explanations for risky actions and generates accurate SBOMs by directly observing the software build process, offering a robust defense against evolving threats. → securityweek.com |
| 2026-05-11 2026 | Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack news 1 min read | Plugin version 2.0.13-829.vc72453fa_1c16 of the Checkmarx Jenkins AST plugin is the secure version, after a malicious iteration was published to the Jenkins Marketplace. This compromise, attributed to the TeamPCP hacker gang and potentially the Lapsus$ extortion group, stems from a wider supply chain attack impacting Checkmarx's repositories since March, following a Trivy supply chain incident. → securityweek.com |
| 2026-05-11 2026 | Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged news 4 min read | Analysis of a TeamPCP intrusion targeting a Jenkins plugin, highlighting the evolving landscape of supply chain attacks. This incident underscores the risks associated with untrusted agentic development layers and the growing threat of AI agent skills being exploited for malicious purposes, mirroring concerns around identity-based cyber resilience and the black market for compromised identities. → theregister.com |
| 2026-05-11 2026 | Malicious Hugging Face model masquerading as OpenAI release hits 244K downloads news 4 min read | Library of techniques for defending against malicious Hugging Face models masquerading as legitimate OpenAI releases. This incident highlights the emerging threat of AI repositories as a software supply chain attack vector, with one model, Open-OSS/privacy-filter, reaching 244,000 downloads before removal. The attack involved a malicious loader.py script that delivered infostealer malware targeting browser credentials, cryptocurrency wallets, and system information, bypassing traditional security controls and suggesting links to npm typosquatting and PyPI campaigns. → csoonline.com |
| 2026-05-11 2026 | Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged news 4 min read | Library that detects and mitigates supply chain attacks targeting CI/CD pipelines, as demonstrated by Checkmarx's response to an intrusion involving a sabotaged Jenkins plugin used by TeamPCP. The article highlights the increasing risks associated with untrusted agentic development layers and the potential for AI agent skills to be exploited for supply chain compromise. → theregister.com |
| 2026-05-10 2026 | Supply Chain Attack: Fake OpenAI Repository on Hugging Face Distributes Infostealer Malware Targeting Developers and AI Tools news 4 min read | Library of techniques detailing a supply chain attack involving a fake OpenAI repository on Hugging Face that distributed an infostealer malware. The malware targeted developers by exfiltrating credentials, session tokens, and cryptocurrency wallets from Chromium and Gecko browsers, Discord tokens, and local files. The attack leveraged typosquatting, social engineering, and evasion tactics like disabling SSL verification and checking for VMs, mapping to MITRE ATT&CK techniques such as T1566 (Phishing) and T1555 (Credentials from Password Stores). → rescana.com |
| 2026-05-10 2026 | Official JDownloader site served malware to Windows and Linux users between May 6 and May 7 news 3 min read | Writeup of a supply chain attack on the JDownloader official website, which occurred between May 6 and May 7, 2026. Attackers compromised the site's content management system, altering download links to serve malware instead of legitimate Windows "Alternative Installer" and Linux shell installers. The deployed malware was a Python-based remote access trojan (RAT). Legitimate installers were digitally signed by "AppWork GmbH," while malicious ones were unsigned or signed by suspicious entities like "Zipline LLC" or "The Water Team." The website was taken offline for investigation and remediation, with correct installer links restored. → securityaffairs.com |
| 2026-05-09 2026 | Supply-Chain Attacks in an Era of Automation and Implicit Trust intermediate 7 min read | Analysis of 2026 supply-chain threats, including the Axios compromise and the Trivy campaign, details how attackers exploit trust in automation and developer systems. The Axios incident involved a compromised npm maintainer account leading to RAT distribution via a malicious dependency, impacting numerous production environments. The Trivy attack leveraged credentials to inject malicious artifacts into CI automation, release binaries, and container images, resulting in secret exfiltration. Additionally, the Quest KACE System Management Appliance vulnerability (CVE-2025-32975) demonstrates how unpatched legacy infrastructure becomes a supply-chain risk. |
| 2026-05-08 2026 | DAEMON Tools devs confirm breach release malware-free version news 3 min read | Writeup of DAEMON Tools supply chain attack confirming trojanized installers for version 12.5.1 (free). Hackers used digitally signed installers to backdoor systems, deploying an information stealer and a lightweight backdoor, with QUIC RAT malware observed in at least one instance. Disc Soft Limited released a malware-free version, 12.6, addressing the vulnerability. → bleepingcomputer.com |
| 2026-05-08 2026 | Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise intermediate 2 min read | Library targeting developers' systems with the Quasar Linux RAT (QLNX) implants, a malware designed for credential harvesting from files like .npmrc, .pypirc, and .aws/credentials. QLNX masquerades as a kernel thread, wipes logs, and uses seven persistence methods including systemd and crontab. It features a PAM inline-hook backdoor and a kernel-level eBPF rootkit component to hide processes, files, and network ports, ultimately facilitating software supply chain attacks by compromising publishing pipelines and cloud infrastructure. → thehackernews.com |
| 2026-05-08 2026 | Kaspersky uncovers targeted DAEMON Tools supply chain attack affecting manufacturing government sectors news 4 min read | Writeup of a targeted DAEMON Tools supply chain attack where trojanized installers, signed with legitimate developer certificates, deployed backdoors to select government, manufacturing, and scientific organizations. The attack, active since April 8, 2026, used a typosquatted domain and involved sophisticated techniques comparable to the 3CX supply chain incident, highlighting the risks of widely trusted software for attackers. |
| 2026-05-07 2026 | Supply chain security on alert as M&A targets agent security beginner 3 min read | Library for mitigating supply chain security risks, particularly those amplified by AI. It addresses threats exemplified by the Axios NPM package tampering and trojanized Daemon Tools installers. The library offers solutions and insights relevant to the increasing M&A activity in agent security, such as Cisco's acquisition of Astrix Security and Palo Alto Networks' acquisition of Portkey. It also provides context for OpenAI's GPT-5.5 Cyber and Anthropic's Mythos, noting their capabilities in vulnerability discovery and potential for misuse, alongside Cisco's open-source Model Provenance Kit for AI model verification. |
| 2026-05-07 2026 | Vendor Says Daemon Tools Supply Chain Attack Contained news 2 min read | Analysis of the Daemon Tools supply chain attack details how threat actors injected trojanized versions of Daemon Tools Lite (specifically version 12.5.1) released between April 8 and May 5 with code to collect information and deploy backdoors. Disc Soft has since contained the incident, removed compromised files, and released a clean version (12.6.0.2445), advising users to uninstall the affected software and scan their systems. → securityweek.com |
| 2026-05-07 2026 | Gemini CLI Vulnerability Could Have Led to Code Execution Supply Chain Attack news 1 min read | Vulnerability analysis of Gemini CLI identified a critical flaw (CVSS 10/10) that could enable supply chain attacks. Exploiting indirect prompts in GitHub issues, attackers could bypass tool allowlists in –yolo mode, leading to arbitrary command execution. This allows for the extraction of secrets, gaining write access to repositories, and pushing malicious code to downstream users. The issue, affecting multiple Google repositories and also impacting headless mode via lax trust, was patched in Gemini CLI version 0.39.1. → securityweek.com |
| 2026-05-06 2026 | Remember DAEMON Tools? It Was Hacked to Serve Windows Malware news 4 min read | Writeup on the DAEMON Tools supply chain attack, detailing how a hacker compromised versions 12.5.0.2421 through 12.5.0.2434 distributed from daemon-tools.cc. The attack involved injecting backdoors into installers, impacting thousands of users globally across various sectors, including retail, scientific, and government organizations, with evidence pointing to a Chinese-speaking threat actor. |
| 2026-05-06 2026 | Invisible Supply Chain Attack Risks and Trusted Access beginner 5 min read | Library for detecting invisible supply chain attacks that weaponize trust in browsers, third-party services, and user behavior, bypassing traditional defenses by leveraging legitimate access paths. It details techniques like phishing pages requesting device permissions, QR code-based quishing, and adversary-in-the-middle attacks to intercept credentials and MFA codes, emphasizing the need for strict permission governance, behavioral monitoring, and Zero Trust architectures. |
| 2026-05-06 2026 | Malware Brief: Air gaps breached CPUs hijacked and supplychain chaos news 3 min read | Analysis of APT37's Ruby Jumper, FAUX#ELEVATE cryptominer, and CanisterWorm supply-chain malware reveals attackers targeting air-gapped systems via removable media and cloud services, distributing illicit Monero miners through weaponized résumés, and automating propagation across open-source packages and CI/CD pipelines. These threats exploit assumed trust in isolation models, business workflows, and software supply chains, reducing defender reaction time and increasing blast radius. |
| 2026-05-06 2026 | Critical DAEMON Tools Supply Chain Attack: Malware-Compromised Windows Installers Threaten Organizations and Home Users (Versions 12.5.0.242112.5.0.2434) news 5 min read | Writeup detailing a critical supply chain attack on DAEMON Tools Windows installers (versions 12.5.0.2421-12.5.0.2434), which distributed malware via trojanized executables signed with a legitimate AVB Disc Soft certificate. The malware, including an info-gatherer, backdoor, and QUIC RAT, exfiltrates system data and deploys advanced implants to targeted organizations and home users, leveraging MITRE ATT&CK techniques like T1195.002 (Supply Chain Compromise) and T1553.002 (Code Signing). → rescana.com |
| 2026-05-06 2026 | Video game supply chain attack Bleeding Llama US gets early LLM access news | |
| 2026-05-06 2026 | Attackers compromised Daemon Tools software to deliver backdoors news 2 min read | Analysis of a supply chain attack where attackers compromised Daemon Tools, a popular Windows utility, to deliver backdoors. Signed, trojanized installers served from the official website (versions 12.5.0.2421-12.5.0.2434) downloaded a .NET information collector. This collector gathered system details for targeted deployment of payloads like a minimalistic backdoor and QUIC RAT, capable of injecting into legitimate processes. The attack leveraged legitimate digital certificates, making malicious binaries appear trustworthy. → helpnetsecurity.com |