The XCPE botnet was a large-scale malware operation involving over 1.3 million set-top boxes infected with a backdoor developed and operated by Videostrong Technology Co., an Android device manufacturer. The backdoor enabled criminal affiliates to conduct ad-fraud, create residential proxy networks, and install additional malware. The botnet infrastructure spanned multiple years and device models. Google and industry partners dismantled the botnet, banned Videostrong from Android certification, and improved firmware integrity reviews for Android TV devices to prevent recurrence.
In October 2026, nine AI developer platforms suffered security breaches involving credential theft that allowed attackers to abuse AI model access. Platforms affected include Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Attackers exploited vulnerabilities to access stored environment variables containing AI credentials and monetized this access through LLM broker infrastructure. Follow-up activities included validation sweeps, quota enumeration, and large-scale token abuse resembling resold coding-agent traffic. Documented cases show hundreds of thousands to over a million unauthorized API calls generating over $100,000 in fraudulent usage. Multiple reseller operations were identified selling discounted access to frontier AI models using stolen credentials.
Since September 15, 2026, the Gheist campaign has been abusing stolen GitHub tokens to commit a malicious workflow named sync-check to accessible repositories. This workflow attempts to print repository secrets into logs, which are then exfiltrated via GitHub's API before the logs are deleted. The campaign has affected over 850 compromised accounts and more than 13,500 planted branches, impacting both personal and enterprise private repositories. GitHub's approval controls have prevented exploitation in public repositories, but private and enterprise repositories remain vulnerable. The campaign operates without a command-and-control server, uses the user agent 'gheist', and has multiple evolving variants. Approximately two-thirds of affected accounts have been removed by GitHub, likely as a response measure.
A malicious campaign involving at least ten Visual Studio Code extensions distributed via the VS Code Marketplace and Open VSX registries has been identified. Two confirmed malicious themes execute threat actor-controlled code using encrypted JavaScript loaders, Russian-language gating, and Solana blockchain transaction memos for dynamic payload resolution. These extensions have been installed tens of thousands of times, posing a significant supply chain risk. Some extensions remain unweaponized but retain executable capabilities. The campaign is linked to the GlassWorm threat actor and uses brandjacking and infrastructure rotation tactics to evade detection.
The Lazarus subgroup TraderTraitor conducted targeted campaigns in 2026 against cryptocurrency-related and non-cryptocurrency entities, including a notable $292 million theft from KelpDAO via LayerZero. A smaller IT services provider in India was also compromised through social engineering involving fake job interview lures with weaponized Terraform projects. Malicious GitHub repositories with typosquatted domains delivered macOS backdoors FLATROOF and ROOFDECK during terraform init execution. These backdoors facilitated reconnaissance, credential theft, and cloud environment escalation. After public disclosure of the LayerZero attack, attackers deployed an updated ROOFDECK backdoor and removed earlier implants, continuing activity until June 2026 before abandoning the intrusion due to low value from the smaller target.
The PolinRider campaign compromises developer GitHub accounts to inject malicious code into development versions of popular packages, including visanduma/nova-two-factor on Packagist. It targets multiple ecosystems such as npm, PyPI, Go modules, Packagist, and Chrome extensions by abusing Git-based collaboration workflows rather than directly compromising package registries. The attackers use advanced techniques like rewriting Git history, hiding payloads in configuration and font files, and triggering execution via IDE tasks. PHP projects are specifically targeted with obfuscated JavaScript executed through shell_exec calls. The campaign is attributed to North Korean actors focusing on cryptocurrency theft.
BambooToken is a multiplatform malware family active since at least February 2023 that uses the MQTT protocol for covert command and control. It targets Windows and Linux systems primarily across Asia and South America, infecting backend servers in various sectors including mobile apps, legal, financial, software, hotels, and GitLab instances. The malware employs sideloading via Tendyron's OnKey authentication software, common in Chinese banking and government networks. It has capabilities for host enumeration, antivirus detection, and potential keylogging and clipboard theft. The attacker uses MQTT's publish-subscribe model and Cloudflare proxies to conceal infrastructure and operations. The campaign demonstrates sophisticated operational security and widespread infections.
A phishing campaign abuses npm package mirrors to host fake Cloudflare Captcha pages embedded in malicious npm packages. These pages are served via trusted mirror domains, increasing their credibility and facilitating phishing attacks such as ClickFix delivery. The campaign uses typosquatted domains and legitimate key-value storage services to redirect victims dynamically. Downloading the packages is not harmful, but accessing the HTML files through mirror URLs exposes users to phishing risks.
A sophisticated software supply chain attack named ChainDrop has infected hundreds of npm packages, including popular caching libraries with millions of weekly downloads. Beginning August 4, 2026, attackers compromised a GitHub account of a keyv package maintainer, injecting malicious code into legitimate repositories. The malware executes credential-stealing payloads targeting developer workstations and CI/CD runners, harvesting npm tokens, GitHub credentials, cloud access keys, SSH keys, and database credentials. Using stolen credentials, the worm self-propagates by compromising additional repositories and publishing poisoned packages with valid provenance attestations. ChainDrop employs Bun runtime for execution, establishes persistence through developer tool configurations, and exfiltrates encrypted data using blockchain-based command-and-control infrastructure. This campaign represents an evolution of the Shai-Hulud npm worm.
A long-running campaign compromised the QuickFox VPN application, primarily used by Chinese users to access Chinese resources and improve gaming experiences. Active since August 2025, the attack involved trojanized Windows installers (versions 3.0.51.0 through 3.59.5) that deployed malicious JavaScript through modified Electron renderer HTML files. The JavaScript loader fingerprinted victim endpoints using process-based guardrails, checking for specific applications including administrative tools, cryptocurrency wallets, and Chinese translation software while avoiding Steam users. Successfully profiled targets received an FDMTP implant through DLL sideloading techniques using legitimate Microsoft Azure binaries. The infrastructure demonstrates active development with multiple staging domains masquerading as legitimate services. QuickFox removed malicious components from version 3.59.6 following responsible disclosure. Technical overlaps suggest possible connections to Twill Typhoon, though attribution remain
Attackers compromised a GitHub maintainer account controlling keyv, cacheable, flat-cache, and file-entry-cache Node.js packages that collectively receive over a billion downloads monthly. Malicious code was pushed directly to the main branch and automatically published to npm with valid signatures. A hidden preinstall script downloads a Bun runtime to execute an obfuscated payload that harvests npm, GitHub, AWS, Kubernetes, and Vault credentials, scans for SSH keys and environment files, and exfiltrates data to attacker-controlled GitHub repositories and Ethereum smart contracts. The worm then uses stolen npm tokens to infect additional packages autonomously. This self-propagating attack, tracked as ChainDrop, belongs to the Shai Hulud family responsible for previous campaigns targeting TanStack, Mistral AI, and OpenSearch packages in May 2026.
Malicious browser extensions distributed through Chrome Web Store and Firefox Add-ons marketplaces posed as free VPN services while secretly stealing clipboard data. The Chrome extension, with 146 users, and Firefox extension, with 3,499 users, initially functioned as proxy tools but later incorporated clipboard theft through staged updates. Chrome versions 1.1 onwards and Firefox version 1.3.3 onwards continuously monitored clipboard contents every 500-1500 milliseconds, capturing passwords, API keys, cryptocurrency addresses, and authentication tokens. Stolen data was chunked, tagged with session identifiers, and exfiltrated via HTTP to attacker-controlled infrastructure at multiple IP addresses. Both extensions shared code patterns, infrastructure, and exfiltration endpoints despite appearing as separate products, indicating coordinated malicious operations behind legitimate-appearing privacy tools.
A newly identified threat group, designated as GhostShell, has been conducting cyber operations against Ukraine's unmanned aerial vehicle supply chain since February 2026. The attackers employ malicious archives containing decoy documents that impersonate Besomar, a Ukrainian manufacturer of high-precision interceptor drones, to compromise defense and procurement networks. The attack chain deploys three distinct payloads: a custom backdoor (122.exe) utilizing mTLS client certificates for screen capture and command execution, an in-memory stager (update.exe) disguised as a Windows Health Service that fetches next-stage payloads via Telegram, and a proxy launcher (22.exe) that tunnels traffic through Xray Core to deploy the Vidar v2 information stealer. The targeting strongly suggests a Russian cyber operation, though analysts employ the SOLBIT framework to avoid attribution based on easily forgeable indicators.
A sophisticated supply chain attack leverages typosquatting of the legitimate postcss-selector-parser npm package, which receives over 150 million weekly downloads. Three malicious packages published by user 'abdrizak' masquerade as PostCSS utilities while delivering a multi-stage Windows RAT. The infection chain begins with encoded JavaScript that drops PowerShell scripts, which then download a bundled Python runtime containing Nuitka-compiled modules. The final payload implements comprehensive RAT capabilities including HTTP C2 communication with RC4 encryption, registry persistence, VM detection, remote shell execution, file transfer, and Chrome credential theft using DPAPI and app-bound decryption. The attack demonstrates how build tooling dependencies can serve as delivery mechanisms for sophisticated Windows malware targeting developer environments.
Trojanized Visual Studio Code extensions distributed via the Open VSX marketplace deliver a sophisticated WebAssembly-based attack chain. The extensions ship ChaCha20-encrypted TinyGo-compiled WebAssembly modules that poll the Solana blockchain for command-and-control instructions embedded in transaction memos. This novel dead-drop technique allows attackers to rotate infrastructure without hardcoded servers. Once activated, the modules read attacker instructions from a monitored Solana wallet address, then execute platform-specific download-and-execute commands via Node.js child_process to deploy second-stage payloads. The campaign impersonates legitimate extensions on Open VSX, exploiting cross-registry trust gaps to target VSCodium, Cursor, Windsurf, and other VS Code forks. Attribution points to GlassWorm-associated tradecraft with medium confidence, representing a new WebAssembly-based variant of previously documented supply chain compromise techniques.
Bad actors exploited Kuse, a legitimate AI-based workplace application, to conduct a phishing campaign. Attackers leveraged a Vendor Email Compromise (VEC) to send malicious emails from a trusted vendor's compromised mailbox, establishing initial trust. The attack utilized Kuse's file-sharing features to host a fake blurred document with a Markdown file extension (.md) under the legitimate domain app[.]kuse[.]ai. Victims were presented with a fabricated document preview containing Spanish text prompting them to click a link. This redirected users to a fraudulent Microsoft login page designed to harvest credentials. The attack combined multiple social engineering techniques including domain trust exploitation, unusual file extensions to evade detection, and vendor relationship abuse to bypass security controls and user scrutiny.
The npm ecosystem experienced a critical shift in September 2025 with the Shai-Hulud worm, marking the transition from isolated attacks to systematic supply chain compromises. In April 2026, TeamPCP launched a coordinated campaign through a malicious @bitwarden/cli package targeting multiple distribution channels including Docker Hub, GitHub Actions, and VS Code extensions. The multi-stage payload employs advanced obfuscation, harvests credentials from cloud providers and developer workstations, exfiltrates data through encrypted HTTPS and GitHub repositories, and self-propagates by backdooring npm packages using stolen tokens. The malware implements GitHub's search API as a resilient command-and-control fallback mechanism and features anti-detection measures including Russian locale killswitches. This represents an evolution toward wormable propagation, infrastructure-level persistence, and dormant payloads that activate under specific conditions.
On March 31, NSFOCUS CERT detected that the npm repository of the HTTP client library Axios was poisoned by the supply chain. The attacker bypassed the normal GitHub Actions CI/CD pipeline of the project, changed the account email address of the axios maintainer to an anonymous ProtonMail address, and manually released a malicious version with a Trojan backdoor through the npm CLI. When the user installs it, a persistent remote control will be established on the host. The impact is wide-ranging, and relevant users are requested to take measures for investigation and protection as soon as possible.
TeamPCP uploaded malicious versions of the telnyx Python SDK to PyPI, compromising a package with 750,000 monthly downloads. The attack uses a three-stage architecture: a trojanized package triggers a platform-specific loader, which downloads a second-stage payload hidden in a WAV file using steganography, deploying a credential harvester. The harvester steals various credentials, encrypts them, and exfiltrates to the attacker's C2. The attack works across major operating systems and spreads through Kubernetes clusters. This is part of a broader TeamPCP supply chain campaign that has targeted multiple packages over nine days. The sophisticated attack includes WAV and PNG steganography, hybrid encryption, Kubernetes lateral movement, and a full-featured RAT on Windows with advanced evasion techniques.
A malicious supply chain attack has been discovered in the Python Package Index package litellm version 1.82.8. The compromised package contains a malicious .pth file that executes automatically when the Python interpreter starts, without requiring explicit import. This file, located in site-packages/, exfiltrates sensitive information including environment variables, SSH keys, and cloud credentials to an attacker-controlled server. The payload is double base64-encoded to evade basic static analysis. PyPI administrators have quarantined the project to limit its spread. Users are advised to check for the malicious file, rotate all potentially exposed credentials, and audit their PyPI publishing process. The attack is attributed to TeamPCP and is actively exploited in the wild.
