8 casos · pág. 1/1
On October 21, 2026, attackers compromised the LiteLLM release pipeline and published malicious version 1.107.0 to PyPI, Docker Hub and GHCR. The package carried a credential stealer ("privcollect") and a backdoor that runs remote code every hour, effectively a RAT. LiteLLM suspects the attacker obtained developer GitHub CLI OAuth tokens …
A Hacktron researcher argues that AI-assisted vulnerability research is rapidly widening the enterprise attack surface. He cites recent breaches at Vercel and GitHub and a wave of critical CVEs in F5, Fortinet, Cisco, Palo Alto and ImageMagick. According to the author, the Vercel compromise began with a breach of the AI platform Context.a…
Throughout October 2026, Wiz observed an actor using tooling associated with ARTEX, an open-source autonomous AI penetration-testing framework, against multiple IT and software vendors. The activity targeted identity providers (Okta, Entra ID, AWS Cognito) and Microsoft 365 integrations, with repeated attempts to bypass authentication, en…
Lazarus Group, linked to North Korea, ran a cyberespionage campaign dubbed Operation FlashHole against South Korean organizations. The campaign combined spear-phishing, tailored websites, abuse of the financial security application INISAFE CrossWeb EX, and modular malware that ran largely in memory. It follows Operation SyncHole, which ab…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korean organizations. It follows Operation SyncHole and is placed within the broader Cascade Hole activity. The earliest evidence dates to July 2025 (securelist.com, bleepingcomputer.com), and Kaspersky identified at least three victims in the sof…
The LiteLLM release 1.107.0 (a widely used open source LLM proxy and AI gateway developed by BerriAI, about 23 million weekly downloads per theregister.com) was trojanized on PyPI on 21 October 2026 and carries a credential stealer (privcollect) plus a remote code execution backdoor. All wheels (Linux, macOS, Windows) drop three extra fil…
Microsoft assesses that the China-aligned actor Storm-0940 used the agentic AI penetration testing framework ARTEX to compromise the Microsoft 365 tenants of ConnectWise, then pivoted to its downstream customers. The campaign began in September 2026 and targeted hundreds of organizations worldwide across aerospace and defense, energy, fin…
Microsoft attributed the recent supply chain compromise of the ConnectWise Cloud Backup application to Storm-0940, a China state-aligned actor. The actor used ARTEX, a Go-based agentic AI penetration testing framework, to automate reconnaissance, password spraying and OAuth application abuse at "machine speed" against hundreds of organiza…
