Supply Chain Attack
For the second time in weeks, Microsoft packages were laced with credential stealers — this time targeting users of AI coding agents, forcing the company to pull more than 70 of its own GitHub repositories.
Supply Chain Attack
Another package-poisoning incident lands across a language registry, reinforcing the case for default-behavior reform that GitHub has now begun applying to npm.
Nation-State Cyber Threats
ReliaQuest disclosed OP-512, a previously unreported, China-linked espionage cluster that plants a custom three-web-shell framework on Microsoft IIS servers — the fourth such group to target IIS in a year. For anyone running IIS, it is a prompt to go hunting.
Cyber Attacks
Hunt.io found that a threat actor called PCPJack hijacked about 230 AWS, Google Cloud and Azure servers into a covert SMTP relay network — quietly converting business servers into verified mail proxies synced to a downstream consumer every five minutes.
Supply Chain Attack
Three disclosures this cycle share one thesis: attackers borrowing the trust of legitimate channels. A Rust-written npm worm (IronWorm), a cryptominer slipped into Hola Browser, and a Magecart skimmer hosted inside Stripe each hide in traffic defenders are inclined to allow.
Malware
McAfee Labs says WeedHack, a free-to-start Minecraft malware-as-a-service, has infected over 116,000 systems since January via fake mods pushed on YouTube and through SEO poisoning — and some buyers are using its remote-access tools to spy on and harass other players.
Malware
Silent Push has named DriveSurge, a pay-per-install access broker that has quietly hijacked thousands of legitimate websites and routes their visitors — on both Windows and macOS — into ClickFix and fake-update malware lures using an off-the-shelf traffic distribution system.
Nation-State Cyber Threats
Seqrite Labs says the Pakistan-aligned group SideCopy likely ran Operation XENOFISCAL, a spear-phishing campaign that hit Afghanistan's Ministry of Finance and provincial finance offices with the open-source Xeno RAT, delivered through a Pashto-language ZIP-and-LNK lure.
Supply Chain Attack
A compromised Red Hat employee GitHub account pushed a new 'Miasma' build of the Mini Shai-Hulud worm into 32 Cloud Services npm packages. Red Hat says the code was internal-only and never reached customers; any pipeline that installed a poisoned version should rotate its secrets.
Malware
Unit 42 documented Operation FlutterBridge, a macOS malvertising campaign that uses hundreds of Google-verified ads to drop FlutterShell — a new backdoor built with Google's Flutter framework that adds shell execution, file manipulation and AI-summarization-based exfiltration to adware.
Artificial Intelligence (AI)
Sophos documented a threat actor using AI agents — including a Claude Opus 4.5 coordinator — to run a lab testing malware against Sophos, CrowdStrike and Microsoft Defender. Notably, the lab's own claims of rising evasion success were not borne out by Sophos's data.
Nation-State Cyber Threats
Seqrite Labs disclosed Operation Dragon Weave, a China-aligned cyber-espionage campaign delivering an AdaptixC2 agent against government, research, academic, technology, and financial-services targets in the Czech Republic and Taiwan via spear-phishing ZIPs.