Mur d'images - Cyberveille

curated by Decio

Twilio denies breach following leak of alleged Steam 2FA codes

RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)

Malicious PyPI Package Targets Discord Developers with Remot...

wget to Wipeout: Malicious Go Modules Fetch Destructive Payload

Linux wiper malware hidden in malicious Go modules on GitHub

Using Trusted Protocols Against You: Gmail as a C2 Mechanism...

JFrog Detects Malicious PyPi package Stealing Crypto Tokens

XRP supply chain attack: Official NPM package infected with crypto stealing backdoor

npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors

The Rise of Slopsquatting: How AI Hallucinations Are Fueling a New Class of Supply Chain Attacks

Large enterprises scramble after supply-chain attack spills their secrets

Microsoft spots XCSSET macOS malware variant used for crypto theft

8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur

Go Module Mirror served backdoor to devs for 3+ years - Ars Technica

New details reveal how hackers hijacked 35 Google Chrome extensions

A new playground: Malicious campaigns proliferate from VSCode to npm

Supply Chain Attack on Rspack npm Packages Injects Cryptojac...

zizmor would have caught the Ultralytics workflow vulnerability

Ultralytics AI model hijacked to infect thousands with cryptominer

Python Crypto Library Updated to Steal Private Keys

Triad Nexus: Silent Push exposes FUNNULL CDN hosting DGA domains for suspect Chinese gambling sites, investment scams, a retail phishing campaign, and a polyfill.io supply chain attack impacting 110,000+ sites

Researchers link Polyfill supply chain attack to huge network of copycat gambling sites

Malicious Python Package Targets macOS Developers

Fake AWS Packages Ship Command and Control Malware In JPEG Files

Iraq-based cybercriminals deploy malicious Python packages to steal data

Persistent npm Campaign Shipping Trojanized jQuery

Supply Chain Compromise Leads to Trojanized Installers | Rapid7 Blog

RoguePuppet – A Critical Puppet Forge Supply Chain Vulnerability

Polyfill claims it has been 'defamed', returns after domain shut down

Malicious PyPI packages targeting highly specific MacOS machines

What we know about the xz Utils backdoor that almost infected the world

AI bots hallucinate software packages and devs download them

Over 170K users hit by poisoned Python package ruse

Info Stealing Packages Hidden in PyPI

Three New Malicious PyPI Packages Deploy CoinMiner on Linux Devices | FortiGuard Labs

Supply chain attack targeting Ledger crypto wallet leaves users hacked

Diamond Sleet supply chain compromise distributes a modified CyberLink installer

The Ticking Supply Chain Attack Bomb of Exposed Kubernetes Secrets

Dozens of npm Packages Caught Attempting to Deploy Reverse Shell

Python obfuscation traps

Users of Telegram, AWS, and Alibaba Cloud targeted in latest supply chain attack

The evolutionary tale of a persistent Python threat

Trojanized Free Download Manager found to contain a Linux backdoor

Developers Warned of Malicious PyPI, NPM, Ruby Packages Targeting Macs - SecurityWeek

Nascent Malware Campaign Targets npm, PyPI, and RubyGems Developers

VMConnect supply chain attack continues, evidence points to North Korea - Security Boulevard

Six Malicious Python Packages in the PyPI Targeting Windows Users

Operation Brainleeches: Malicious npm packages fuel supply chain and phishing attacks

PyPI Attackers Still At It: Malicious Packages Drop Trojans and Info-stealers

Hijacking S3 Buckets: New Attack Technique

Bad Actors Are Joining the AI Revolution: Here’s What We’ve Found in the Wild

Software Maker 3CX Was Compromised in First-of-its-Kind Threaded Supply-Chain Hack

X_Trader Supply Chain Attack Affects Critical Infrastructure Organizations in U.S. and Europe

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

Hackers compromise 3CX desktop app in a supply chain attack