All news in category “Incidents and Data Breaches”

⚠ Microsoft has alerted to a late-February 2026 campaign that uses WhatsApp messages to deliver malicious Visual Basic Script (VBS) files which trigger a multi-stage infection chain. According to Microsoft Defender, the scripts create hidden folders under C:\ProgramData, drop renamed Windows utilities (for example, curl.exe as netapi.dll and bitsadmin.exe as sc.exe), and retrieve secondary payloads from trusted cloud providers. Attackers then attempt UAC tampering, modify registry entries, and install unsigned MSI packages to secure persistence and remote access, with some installers deploying legitimate remote‑access tools.

🛡️ Microsoft warns of a WhatsApp-distributed malware campaign that uses malicious Visual Basic Script (VBS) files to gain persistence and remote access on Windows systems. The VBS scripts perform delayed, multi-stage execution and deploy renamed legitimate utilities (for example, curl.exe and bitsadmin.exe) under misleading filenames to blend in. Payloads are hosted on reputable cloud providers and culminate in installing malicious Microsoft Installer (MSI) packages that act as backdoors. Microsoft recommends monitoring script and installer execution and watching for misuse of trusted system tools.

🛡️According to the Iranian judiciary's mouthpiece Misan, the exile news portal Iranwire was allegedly breached and a large volume of sensitive material was taken, including correspondence, staff lists, informant identities and other highly confidential records. The site displayed a maintenance notice while continuing to post on social media, and authorities blamed the hacker group Handala, which has been linked to prior operations.

🚨 Hambardzum Minasyan has been extradited to the United States and charged over his alleged role as a principal developer of RedLine, a prolific infostealing malware. Prosecutors say he set up virtual servers, domains and a cryptocurrency account to distribute and monetize the malware and provided customer support to affiliates. The arrest follows the international Operation Magnus seizure of RedLine infrastructure, which yielded a database that aided investigators. Authorities urge organizations and individuals to strengthen cybersecurity and review the Operation Magnus resources to check for exposed credentials.

🔔 Threat actors compromised maintainer Jason Saayman's accounts to publish malicious versions of axios that included the plain-crypto-js dependency, distributing cross-platform remote access trojans (RATs). The attackers staged the dependency before the takeover, changed the maintainer’s email for persistence, and used stolen npm credentials to publish malicious releases. npm removed the tainted packages and revoked tokens within about three hours while researchers urge audits of lockfiles, CI/CD systems and credential rotation.

🛡️ Google's Threat Intelligence Group has attributed a supply chain compromise of the popular Axios npm package to a suspected North Korean cluster tracked as UNC1069. Attackers seized a maintainer npm account and pushed trojanized releases (1.14.1 and 0.30.4) that added a malicious dependency, plain-crypto-js. That dependency used a postinstall hook to deploy an obfuscated dropper (SILKBELL) which fetched OS-specific payloads and ultimately installed the WAVESHAPER.V2 backdoor. Organizations should audit dependency trees, search node_modules for plain-crypto-js, isolate affected hosts, block the C2 domain sfrclak[.]com, and rotate credentials.

🔓Anthropic confirmed that internal source code for its coding assistant Claude Code was inadvertently published after a packaging error when version 2.1.88 was released to npm. The package included a source map exposing nearly 2,000 TypeScript files and over 512,000 lines of code; the release has since been removed. Anthropic says no customer data or credentials were exposed and is implementing measures to prevent recurrence.

🔒 On March 31, 2026, threat actors used stolen maintainer credentials to compromise the widely used Axios npm package and distribute platform-specific variants of the ZshBucket implant. Observed samples target Linux, macOS and Windows and retain prior profiling and exfiltration behavior while adding a common JSON messaging protocol. The updated implants support binary injection, arbitrary script execution, file system enumeration and remote termination. CrowdStrike attributes the activity to STARDUST CHOLLIMA with moderate confidence based on ZshBucket linkage and infrastructure overlaps.

🔓 An Anthropic employee accidentally published a source map in a public npm package, which allowed the proprietary source for Claude Code to be reconstructed. Anthropic says this was a release packaging error and that no sensitive customer data or credentials were exposed, and that it is rolling out measures to prevent recurrence. Security experts warn that source maps reveal original code, comments, internal constants and prompts, making vulnerabilities and secrets easier to find; the same mistake reportedly occurred previously.

⚠️ Unit 42 describes a multi-stage supply chain campaign by TeamPCP that compromised widely used security and developer tooling, including Trivy, KICS, LiteLLM, and the Telnyx Python SDK. The attackers injected infostealer payloads into GitHub Actions and PyPI/npm packages to harvest cloud tokens, SSH keys, Kubernetes secrets, and LLM API keys while preserving normal tool behavior. The operation leveraged decentralized ICP canisters for resilient C2 and deployed a worm/wiper named CanisterWorm, prompting urgent CI/CD and cloud identity hardening guidance.

🚨 Attackers compromised the npm account of Axios' lead maintainer and pushed trojanized releases that install a cross-platform remote access trojan on developer machines. The malicious versions axios@1.14.1 and axios@0.30.4 pulled a staged dependency plain-crypto-js@4.2.1 containing a postinstall dropper. Multiple security vendors detected the packages within minutes and npm removed them within two to three hours, but the short window was enough to affect many environments.

🔐 Cisco has confirmed a breach of its internal development environment after threat actors leveraged credentials stolen in the recent Trivy supply-chain compromise. Attackers used a malicious GitHub Action to harvest CI/CD credentials and clone more than 300 repositories, including source for AI-powered products and some customer code. Multiple AWS keys were also taken and used in limited unauthorized activity. Cisco has isolated affected systems, begun reimaging, and is rotating credentials while investigating ongoing fallout tied to related supply-chain attacks.

⚠ A high-severity update integrity flaw in TrueConf client (CVE-2026-3502, CVSS 7.8) has been exploited in the wild as part of the TrueChaos campaign. An attacker who controls an on‑premises TrueConf server can substitute legitimate update packages with poisoned installers that lead to arbitrary code execution via DLL side‑loading. Check Point observed the operation targeting government entities in Southeast Asia and linking activity to a Chinese‑nexus actor. Vendor patches are available in TrueConf Windows client 8.5.3 and organizations should apply them and verify update integrity.

🚨 A Maryland man has been charged with stealing more than $53 million after allegedly exploiting flaws in smart contract code on the Uranium Finance decentralized exchange in April 2021. Prosecutors say two separate attacks targeted liquidity pools, including manipulation of a rewards calculation and a transaction verification bug that enabled massive withdrawals while depositing almost nothing. Authorities allege the proceeds were laundered through decentralized exchanges and Tornado Cash, with roughly $31m in crypto and collectibles seized.

🔍Phantom Stealer, a .NET-based infostealer sold as part of a commercial cybercrime toolkit, harvests browser credentials, cookies, saved passwords, autofill and payment card details as well as messaging and email session data from infected systems. Group-IB observed a sustained phishing campaign between November 2025 and January 2026 that targeted logistics, manufacturing and technology organizations across Europe in five waves. Emails impersonated an equipment trading company and carried archive attachments with obfuscated JavaScript droppers or malicious executables. Indicators such as SPF failures, missing DKIM, reused templates and consistent spelling mistakes pointed to automated, template-driven stealer-as-a-service activity, with stolen data exfiltrated via messaging platforms, SMTP and FTP.

⚠️ Google Threat Intelligence Group (GTIG) observed a supply-chain attack on 2026-03-31 where attackers introduced a malicious dependency, plain-crypto-js, into legitimate axios releases (1.14.1 and 0.30.4). The package contains an obfuscated Node.js dropper (SILKBELL) that installs the multi-platform WAVESHAPER.V2 backdoor on Windows, macOS, and Linux. GTIG attributes the activity to UNC1069 and publishes IOCs and remediation steps for affected developers and organizations.

⚠️ Hackers hijacked the npm account for Axios, a widely used JavaScript HTTP client, to publish two malicious releases on March 31, 2026. The attacker added a trojanized dependency (plain-crypto-js@^4.2.1) that runs a post-install dropper (setup.js) which fetches OS-specific RATs from a C2 server. The payloads target Windows, macOS, and Linux and include persistence and evasion techniques, while the dropper attempts to erase traces and restore a clean package.json after infection.

🛡️ Microsoft Defender Experts (DEX) observed a late-February 2026 campaign leveraging WhatsApp messages to deliver malicious Visual Basic Script (VBS) files. Executing the VBS creates hidden folders under C:\ProgramData, drops renamed legitimate Windows utilities, and uses them to download additional payloads from cloud services such as AWS, Tencent Cloud, and Backblaze B2. Attackers escalate privileges, tamper with UAC and registry settings, and install unsigned MSI packages to establish persistent remote access. Microsoft recommends hardening script hosts, monitoring cloud traffic and registry changes, and enabling Defender protections.

🔒 Check Point Research identified an Iran-linked password-spraying campaign targeting Microsoft 365 cloud environments carried out in three waves on March 3, March 13, and March 23. The campaign primarily focused on Israel and the UAE, affecting more than 300 organizations in Israel and over 25 in the UAE. Activity tied to the same actor was also observed against a limited number of targets in Europe, the United States, the United Kingdom, and Saudi Arabia. These attempts seek account takeover and cloud footholds, highlighting the need for strengthened access controls and faster detection.

🔐 Researchers at Wiz report that TeamPCP has been harvesting, validating, encrypting and exfiltrating cloud credentials, SSH keys, Kubernetes configs and other development secrets from compromised supply chain components to attacker-controlled domains. The group used typosquatting on PyPI to push credential-stealing malware into packages affecting Trivy, KICS, LiteLLM and Telnyx. Wiz warns this activity appears linked to, or at least shared with, extortion-focused actors such as Lapsus$, and vendors report claims of partnerships with ransomware affiliates, raising the risk of follow-on ransomware campaigns.