14 casos · pág. 1/1
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…
Between April and July 2026, a threat actor tracked as UNC7017 compromised AOMEI update and notification infrastructure and used it to push malware to users of AOMEI Backupper. The attackers briefly altered two configuration files and restored them within minutes to evade detection. The campaign was uncovered by ManageEngine's Threat Anal…
A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate con…
Two beta versions in the @joyfill npm scope, published on July 28, 2026, carried the same blockchain C2 loader seen in the earlier astro.config.mjs attack, which the article ties to the PolinRider campaign. The attacker published through the legitimate scope (a form-builder SDK with three maintainers) under the beta dist-tag. The maliciou…
SafeDep flagged the malicious npm package ulid-xyz in June 2026. It typosquats ulidx and is a cross-platform remote access trojan. It is delivered through a three-layer transitive dependency chain: ioredis-xyz (a clone of the legitimate ioredis client) depends on redis-type-xyz (an empty manifest posing as Redis OM), which in version 1.10…
On August 28, 2026, an attacker published 10 malicious versions of the npm package @7nohe/openapi-react-query-codegen (about 671K downloads/month) without stealing any credentials. They abused the repository's GitHub Actions release.yml workflow, which had an issuecomment trigger with no author-association gate. Commenting npm publish on …
SafeDep analyzed sckit (the "supplychain.local worm"), a previously unreported cross-platform Go implant framework found on September 23, 2026 in the compromised MemTensor packages @memtensor/email protected (npm) and email protected (PyPI). It harvests credentials from developer machines and CI jobs, takes signed tasks from a C2 server, …
The Mini Shai-Hulud worm from May 2026 is still infecting new GitHub repositories. SafeDep found six repositories that received malicious hook files between 20 and 24 September 2026. The cause is that all tags of the actions-cool/issues-helper GitHub Action, hijacked on 18 May 2026, still point to the malicious commit, and the payload is …
FortiGuard Incident Response reports a supply chain attack on the QuickFox Windows application, whose trojanized components deployed the FDMTP implant to users. QuickFox's user base is mainly Chinese international students and expats. Affected Windows versions are those later than v3.0.35 and earlier than v3.55.6. QuickFox has removed the…
Unit 42 reports that threat actors are moving supply chain malware C2 from hardcoded endpoints to Web3 mechanisms, so an entire botnet or worm infrastructure can be re-pointed with a single blockchain transaction. The ChainDrop npm worm (Shai-Hulud family, 400+ npm packages) and the PolinRider campaign (npm, Go modules, Packagist) target …
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
A malicious version 0.7.4 of the mrmustard photonic quantum computing library (Xanadu) was published to PyPI on July 23, 2026, after the account of the project's lead maintainer (ziofil, Filippo Miatto) was compromised. Importing the package reads SSH private keys, AWS credentials and the Kubernetes config, then sends them to an attacker-…
On September 8, 2026, an attacker added a malicious source dependency to Deep-Live-Cam, a Python face-swapping app with about 96,600 GitHub stars. Commit 7895c547 ("chore: update requirements.txt") rewrote 18 dependency entries and added requests @ git+https://github.com/pypls/requests.git. This points installation to a lookalike reposito…
