3 casos · pág. 1/1
Two beta versions in the @joyfill npm scope, published on July 28, 2026, carried the same blockchain C2 loader seen in the earlier astro.config.mjs attack, which the article ties to the PolinRider campaign. The attacker published through the legitimate scope (a form-builder SDK with three maintainers) under the beta dist-tag. The maliciou…
Kaspersky reports a Lazarus Group operation dubbed FlashHole, targeting South Korean organizations since July 2025 with a complex, mostly in-memory infection chain. The attackers use the NIST-standardized ML-KEM-1024 post-quantum key encapsulation mechanism for C2 communications, so that subsequent payloads are delivered encrypted and are…
Microsoft attributed the recent supply-chain attack on ConnectWise customers' Microsoft 365 environments to Storm-0940, a China-state aligned actor active since 2021. Since at least September 2026 the group has used the open-source agentic AI penetration testing framework ARTEX to automate attacks against hundreds of organizations worldwi…
