Data Breaches
The hackers exfiltrated the data from Checkmarx’s GitHub environment on March 30, a week after publishing malicious code.
Hi, what are you looking for?
SecurityWeek
All posts tagged "supply chain attack"
Supply Chain Security
Tied to a fresh Checkmarx supply chain attack claimed by TeamPCP, the incident references the Shai-Hulud worm.
Artificial Intelligence
The AI giant is taking action after determining that a macOS code signing certificate may have been compromised.
Malware & Threats
Download links were replaced by a Russian-speaking threat actor to distribute a recently emerged malware named STX RAT.
Malware & Threats
Hackers published 36 NPM packages posing as Strapi plugins to execute shells, escape containers, and harvest credentials.
Supply Chain Security
The threat actor behind the Axios supply chain attack has been aiming at other maintainers in its social engineering campaign.
Data Breaches
Hackers stole over 300GB of data from the Commission’s AWS environment, including personal information.
Supply Chain Security
The AI recruiting firm is investigating the incident as Lapsus$ claimed the theft of 4TB of Mercor data.
Application Security
A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored package versions.
Application Security
After validating stolen credentials using TruffleHog, the hacking group started AWS services enumeration and lateral movement activities.
Malware & Threats
Two malicious versions of the popular SDK were uploaded to the PyPI registry, targeting Windows, macOS, and Linux.
Application Security
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
Supply Chain Security
Hackers published a malicious scanner release and replaced tags to point to information-stealer malware.
Malware & Threats
The malicious code propagates like a worm, poisons AI assistants, exfiltrates secrets, and contains a destructive dead switch.
Nation-State
The vulnerability in TeamT5 ThreatSonar Anti-Ransomware was recently added to CISA’s KEV catalog.
Artificial Intelligence
While this campaign targets crypto wallets and steals money, the methodology has far wider potential that could be used by other attackers.
Supply Chain Security
The likely state-sponsored threat actor had access to the hosting provider for months and targeted only certain Notepad++ customers.
Malware & Threats
Hackers compromised a MicroWorld Technologies update server and fed a malicious file to eScan customers.
Supply Chain Security
The protections against NPM supply chain attacks could be bypassed, leading to arbitrary code execution.
Application Security
The worm exposed Trust Wallet’s Developer GitHub secrets, allowing attackers to publish a backdoor extension and steal funds from 2,520 wallets.
CISO Strategy
Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense strategies...
Vulnerabilities
Vulnerabilities
Vulnerabilities
A critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes.
Vulnerabilities
Vulnerabilities
Cybersecurity Funding
Vulnerabilities
