Malware

Flat white line-art of an open package box linked to a document card — jscrambler 8.14.0 npm release compromise.

Supply Chain Attack

jscrambler 8.14.0 npm Release Compromised to Drop a Rust Infostealer at Install

Another JavaScript-ecosystem SDK compromise — defender inventory work continues this week.

Flat white line-art of a shield beside a monitoring screen — Microsoft research on the GigaWiper espionage-and-destructive malware family.

Threat Intelligence

Microsoft Details "GigaWiper," a Malware Family Combining Espionage and Destructive Capabilities

A new destructive-plus-espionage malware family lands on defenders' desks — detection-engineering review this week.

Phishing

Microsoft and Trend Micro Document Blockchain-Abuse Phishing Against EU and Asia Hospitality

Two vendor-documented hospitality-sector phishing campaigns land the same week — sector-advisory work for hotel-industry defenders this week.

Flat white line-art of two malware boxes wired into a central hub with a power-disconnect switch — Operation Endgame Amadey and StealC disruption.

Cybercrime

Microsoft and Europol Disrupt Amadey and StealC Infrastructure in Operation Endgame Phase

Operation Endgame's latest phase takes out Amadey and StealC's shared infrastructure, with Europol and Microsoft reporting 326 servers actioned, 142 domains seized, and roughly 27 million stolen credentials recovered.

Flat white line-art of a large magnifier over a document beside a simple alert card — North Korean-linked NarwhalRAT research disclosure.

Nation-State Cyber Threats

Researchers Detail a North Korean-Linked Campaign Using the NarwhalRAT Family

Another published-research disclosure for defenders to review for indicator relevance: researchers at Genians named NarwhalRAT, a remote access trojan they attribute to a North Korean-linked cluster, and published indicators worth checking against your own telemetry.

Flat white line-art of a key in a server with a hidden duplicate key behind it — decade-long Linux PAM authentication backdoor.

Nation-State Cyber Threats

Chinese APT Backdoors Linux PAM Login Software for Nearly a Decade

One backdoored authentication module, one isolated network, ten years of undetected access — a reminder that critical authentication primitives are a forever-target.

Flat white line-art of a compass needle turning to point back at a single building — OceanLotus domestic targeting.

Nation-State Cyber Threats

ESET Publishes OceanLotus (APT32) Research Update — Domestic Targeting in Vietnam

ESET's research update reframes OceanLotus — the targeting is now inward.

Flat white line-art of an opened archive folder spilling a single document — WinRAR flaw exploited against Ukraine.

Nation-State Cyber Threats

WinRAR Flaw Exploited by Russia-Aligned Groups Against Ukrainian Organizations

Consumer compression software remains a reliable initial-access vector in the Russia-Ukraine cyber theater.

Flat white line-art of a sealed toolbox opening above a row of code repositories — Miasma toolkit open-sourced on GitHub.

Supply Chain Attack

Miasma Supply-Chain Worm Open-Sourced on GitHub

Miasma's open-sourcing turns the previous day's Microsoft-repo incident into the first instance of a much broader supply-chain threat any actor can now reproduce.

Flat white line-art of a code repository folder linked to two robot heads — Miasma worm targeting AI coding agents.

Supply Chain Attack

Microsoft Pulls 70+ GitHub Repos as Miasma Worm Targets AI Coding Agents

For the second time in weeks, Microsoft packages were laced with credential stealers — this time targeting users of AI coding agents, forcing the company to pull more than 70 of its own GitHub repositories.

Flat white line-art of a Python package box flagged and pulled from a shelf of registry crates — Hades PyPI package-poisoning incident.

Supply Chain Attack

PyPI Discloses "Hades" Package-Poisoning Incident; 19 Packages Removed

Another package-poisoning incident lands across a language registry, reinforcing the case for default-behavior reform that GitHub has now begun applying to npm.

Flat white line-art of a web server with a shell-prompt chevron on its face and a magnifier beside it — OP-512 IIS web shells.

Nation-State Cyber Threats

OP-512: A China-Linked Cluster Is Planting Custom Web Shells on Microsoft IIS Servers

ReliaQuest disclosed OP-512, a previously unreported, China-linked espionage cluster that plants a custom three-web-shell framework on Microsoft IIS servers — the fourth such group to target IIS in a year. For anyone running IIS, it is a prompt to go hunting.

See all