axios

Details Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NO_PROXY rules. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. (CVE-2025-62718) It was discovered that Axios did not properly protect certain HTTP header values from prototype pollution. An attacker could possibly use this issue to inject malicious values into outbound requests, resulting in HTTP header injection. (CVE-2026-40175) Sachin Patil and Amol Patil discovered that Axios did not properly apply NO_PROXY rules to certain loopback addresses. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. (CVE-2026-42043) Yu Bao discovered... Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NO_PROXY rules. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. (CVE-2025-62718) It was discovered that Axios did not properly protect certain HTTP header values from prototype pollution. An attacker could possibly use this issue to inject malicious values into outbound requests, resulting in HTTP header injection. (CVE-2026-40175) Sachin Patil and Amol Patil discovered that Axios did not properly apply NO_PROXY rules to certain loopback addresses. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. (CVE-2026-42043) Yu Bao discovered that Axios did not properly protect JSON response processing from prototype pollution. An attacker could possibly use this issue to modify values in application responses, resulting in authorization bypass or privilege escalation. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-42044) It was discovered that Axios did not properly protect certain request configuration options from prototype pollution. An attacker could possibly use this issue to modify outbound HTTP requests, resulting in security restrictions being bypassed. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-42264) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Disponibile PoC per lo sfruttamento della CVE-2026-67320 nella libreria Axios Alert AL03/260803/CSIRT-ITA Sintesi Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-67320 che interessa Axios, nota libreria client http per l'interoperabilità tra ambienti browser e Node.js. Tipologia Information Disclosure Spoofing Descrizione e potenziali impatti Nel dettaglio, la vulnerabilità identificata tramite la CVE-2026-67320 - di tipo "Information Disclosure" e con score CVSS v4.0 pari a 8.3 - è dovuta a una gestione non corretta della configurazione delle richieste da parte della libreria Axios in ambiente Node.js: in particolari condizioni, una precedente compromissione tramite "Prototype Pollution" può consentire l'iniezione di una configurazione proxy malevola attraverso la catena dei prototipi, causando il reindirizzamento delle richieste applicative verso un proxy controllato dall'attaccante. Qualora sfruttata, tale vulnerabilità potrebbe permettere a un attaccante di intercettare e monitorare il traffico HTTP generato dall'applicazione, ottenendo l'accesso a informazioni sensibili quali credenziali, token di autenticazione, intestazioni HTTP, URL completi e dati trasmessi nelle richieste. Inoltre, l'attaccante potrebbe manipolare le risposte restituite all'applicazione, influenzandone il comportamento e facilitando ulteriori attività malevole o accessi non autorizzati a servizi e risorse applicative. Prodotti e versioni affette Axios versioni dalla 0.31.1 alla 0.32.9 versioni dalla 1.15.2 alla 1.17.9 Azioni di mitigazione Si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni fornite dallo sviluppatore e disponibili ai link nella sezione Riferimenti.

A series of attacks on npm libraries including axios was the work of North Korean actors, AWS has said. The cloud computing giant said in a blog post on July 29 that compromises of the axios, debug, chalk and typo-crypto libraries were carried out by the same group, known as Saphire Sleet, BlueNoroff and other monikers. Amazon Threat Intelligence made the connection after analyzing tactics, techniques, and procedures (TTPs) related to the axios attack. “Amazon Threat Intelligence identified shared TTPs across these supply-chain campaigns, including trojanized NPM packages, use of post-install hooks (scripts that run automatically when a package is installed), and code reuse,” CJ Moses, CISO and VP of security engineering at Amazon, explained. “Based on analysis of command-and-control (C2) indicators and TTPs, Amazon Threat Intelligence assesses with medium confidence that these campaigns are attributable to the DPRK-linked threat actor tracked as Saphire Sleet.” In each of the attacks, the playbook was the same. The group socially engineered the package maintainer then published a software update containing malicious code, meaning any organization that automatically pulled these versions received a compromised update. Moses said the typo-crypto compromise in March 2025 was likely a test run for the campaigns that followed, which had a much greater reach. Around 10% of cloud environments were affected by the debug and chalk supply chain attacks in a two-hour window, while axios is one of the most popular JavaScript libraries around, with over 100 million weekly downloads. “By compromising a small number of highly popular packages, the group gains potential access to thousands of downstream environments simultaneously,” said Moses. “For a financially motivated threat actor, this approach is far more efficient than targeting organizations one at a time.” AWS Details Shifting Attacker Tradecraft Moses explained that attacker TTPs are evolving when it comes to targeting open source libraries: Attackers are splitting single malicious workflow across several ordinary-looking packages to make detection harder Threat actors often play the long game, behaving like “real maintainers” for weeks or months before publishing their malicious updates Package contents are often benign: it is the external scripts, configuration files and remote endpoints connected to them that are malicious Obfuscation of the malware itself is getting more sophisticated, including “AES‑GCM encrypted blobs gated by passphrases, RC4-style string arrays with per-call keys, layered XOR over base64, and native loaders” Payloads are becoming smarter to evade sandbox analysis Attackers are using slopsquatting techniques – where they register package names that have been hallucinated by AI coding tools in order to increase victim numbers Despite AWS's efforts, Cris Thomas, security advocate at Semgrep, argued that attribution is best left to governments and law enforcement. “Defenders should not concern themselves too much with who is performing an attack and more with knowing likely techniques of a specific attacker. Distinguishing between one group and another can be helpful for defense teams, knowing whether it is North Korea or Canada is less relevant,” he added. “As always defenders should rely on defense in depth, if one defense doesn't find them another one will. The goal isn't to prevent successful attacks but to identify, limit, block, and correct attacks as soon as possible.”

The North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports. Mastra is an open source TypeScript framework for building AI agents, workflows, and RAG pipelines. It offers integrations for major LLM providers, MCP servers, and cloud deployments. The supply chain attack occurred on June 17. During a 45-minute window, the hackers published 141 packages that contained the malicious dependency easy-day-js, a typosquat of the legitimate dayjs date library. The affected Mastra packages have approximately 8 million weekly downloads. All users who installed a @mastra package during the attack window on June 17 should consider their systems affected. As part of the attack, the hackers compromised the ‘ehindero’ NPM maintainer account, which has publishing rights across the Mastra ecosystem. One day before the account takeover, the attackers published a clean version of easy-day-js to a separate account, ‘sergey2016’. The threat actor used the compromised maintainer account to add easy-day-js as a dependency to 141 NPM packages across the Mastra ecosystem, in such a manner that the latest version of the library would always be installed, and then published the modified packages to NPM. Simultaneously, they published a new, malicious version of the easy-day-js library to their account. An obfuscated postinstall dropper in the dependency would fetch a second-stage payload from the attackers’ servers, write it to the temp directory, execute it as a detached, hidden background process, and then delete itself to hide its tracks. “Because the payload executes during installation, any developer workstation or continuous integration and continuous delivery (CI/CD) pipeline that ran npm install or npm update after the compromised versions were published was potentially exposed, regardless of whether the package was imported in application code,” Microsoft says. Targeting Windows, macOS, and Linux, the malware was designed to masquerade as node-related tools while collecting system information and targeting more than 160 cryptocurrency-related browser extensions. Microsoft has attributed the attack to the financially motivated North Korean group Sapphire Sleet, also known as BlueNoroff, CageyChameleon, Copernicium, and Stardust Chollima, which was also blamed for the Axios supply chain attack. In April, hackers published modified versions of the Axios NPM library that were pointing to a phantom dependency designed to download and execute a cross-platform RAT. Google’s Threat Intelligence Group attributed the attack to UNC1069. Mastra users are advised to remove the affected package versions, check their systems for malware, rotate credentials, tokens, and other secrets, and harden access to their crypto-wallets. Cybersecurity firms Aikido, Ox, Socket, Sonatype, and StepSecurity have published technical details and indicators of compromise (IoCs) associated with the Mastra supply chain attack. Related: More Cybersecurity Firms Disclose Impact From Klue Hack Related: CryptoBandits Malware Doubles as a Backdoor, Abuses Tor Related: NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks Related: Supply Chain Attack Hits 32 Red Hat NPM Packages

Atlassian and Splunk on Wednesday announced patches for multiple vulnerabilities in their products, including critical-severity flaws. Splunk resolved a critical issue in AI Toolkit that could allow authenticated attackers with admin roles to execute arbitrary OS commands on the host the Splunk Enterprise instance runs on. “The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation,” Splunk explains. Tracked as CVE-2026-20266 (CVSS score of 9.1), the security defect was addressed in Splunk AI Toolkit version 5.7.4. If upgrading is not possible, Splunk recommends uninstalling the AI Toolkit as a mitigation. The update also addresses CVE-2026-20265, a medium-severity information disclosure bug caused by an insecure default domain allowlist. An attacker holding the admin or power role could cause the AI Toolkit to make outbound HTTP requests to attacker-controlled servers, leading to data exfiltration. Atlassian published 100 security bulletins that address dozens of security defects across Bamboo Data Center and Server, Bitbucket Data Center and Server, Confluence Data Center and Server, Crowd Data Center and Server, Fisheye/Crucible, Jira Data Center and Server, and Jira Service Management Data Center and Server. All the weaknesses resolved with the fresh security updates appear to affect third-party dependencies used in Atlassian’s products. These include critical-severity issues in Axios (CVE-2026-42043, CVE-2026-40175, and CVE-2026-42264), Apache Tomcat (CVE-2026-41293, CVE-2026-43512, CVE-2026-41293, CVE-2026-43515, and CVE-2026-43515), and Netty (CVE-2026-42584). Users are advised to update to a patched version of the affected Atlassian products as soon as possible. Related: Critical Command Execution Vulnerability Patched in Cisco ISE Related: F5 Patches Critical, High-Severity NGINX Vulnerabilities Related: Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day Related: 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs

Well-architected best practices for software supply chain security There have been multiple notable supply chain attacks using the npm Registry since September: Shai-Hulud, Chalk/Debug, one abusing tea.xyz tokens, and recently axios. Thanks to community efforts involving the Amazon Inspector team, the Open Source Security Foundation, and others, the affected packages were quickly flagged, which reduced the impact of these incidents. Supply chain attacks like Shai-Hulud exploit vulnerabilities on two fronts: compromised maintainer accounts that publish malicious packages, and consumer environments that download and execute those packages. The Shai-Hulud attack, shown in Figure 1, succeeded because maintainer credentials were compromised through phishing, enabling threat actors to publish malicious versions of popular packages. Incidents like these highlight the need for strong security practices within the software supply chain, and effective defense requires addressing both sides. Package maintainers need protections that prevent account compromise and limit sprawl when credentials are stolen. Package consumers need layered defenses that detect malicious packages, prevent their deployment, and limit damage when compromise occurs. In this post, we explore best practices for package consumers. These practices are aligned with the AWS Well-Architected Framework – Security Pillar and you can use them to reduce exposure to similar threats and limit their impact if they occur. Use temporary credentials and grant least privilege When Shai-Hulud executed in developer environments and continuous integration and delivery (CI/CD) pipelines, it scanned for secrets such as npm tokens, GitHub tokens, and AWS Identity and Access Management (IAM) access keys. Long-term credentials exposed in this way enabled threat actors to propagate the malware further and access cloud resources. Recent incidents have shown organizations discovering multiple leaked IAM credential pairs, with concerns about additional exposed credentials and potential compromise of CI/CD pipelines. Removing long-lived credentials from your developer environments and CI/CD pipelines reduces the scope of exposure in the event a system is compromised. For developers working locally, the new AWS CLI login command (aws login) simplifies the process of acquiring short-lived CLI credentials and removes the need to store long-lived credentials in configuration files. AWS IAM Identity Center also provides a straightforward way to acquire temporary credentials that expire automatically. For CI/CD pipelines, OpenID Connect (OIDC) federation with GitHub Actions, GitLab CI, or other platforms provide temporary credentials for each job without storing long-lived tokens. IAM can also federate AWS Identities to external services, allowing your AWS workloads to securely access external services without using long-term credentials. Temporary credentials expire automatically, limiting the window of exposure if a pipeline is compromised. If you’re interacting with a third-party service that doesn’t support temporary credentials, consider storing the credentials to centralized storage using AWS Secrets Manager. Limit access to these secrets, require the use of temporary credentials, and apply automatic rotation and audit logging to reduce the risk of exposure of these credentials. To reduce risk from credential exposure: Use temporary credentials: Federate users from a central identity provider into AWS and use IAM roles for access. SEC02-BP02: Use temporary credentials. Grant least privilege: Assign only the minimum permissions necessary and use temporary elevated permissions where higher privilege is occasionally required. SEC03-BP02: Grant least privilege access. Audit and rotate long-term credentials if they are required for specific use cases. SEC02-BP05: Audit and rotate credentials periodically. In the event of a security incident where credentials might be exposed, immediately rotate all long-term credentials to limit the scope of impact. Use Amazon GuardDuty and AWS CloudTrail to detect abnormal IAM activity and identify which credentials might have been compromised. Implement defense in depth Even with temporary credentials and least privilege, a single compromised account can enable threat actors to publish malicious packages or access sensitive resources. Defense in depth creates multiple layers of protection that work together to prevent sprawl after initial compromise. While adding approval workflows to every operation would dramatically decrease deployment speed, implementing them strategically for sensitive workloads provides balanced security. The key principle is to ensure that if one credential or account is compromised, additional controls prevent that compromise from spreading across your organization. This includes multi-factor authentication (MFA) for access combined with different IAM roles for sensitive workloads. For single-developer open source projects, MFA becomes even more critical because there’s no separation of duties through multiple maintainers. For package maintainers working in team environments, requiring multiple approvers to release packages to production creates separation of duties. However, developers can still trigger merge requests that initiate deployment pipelines, so multi-party approval should be implemented within the pipeline itself for sensitive deployments. This ensures that even if a developer’s credentials are compromised and they trigger a deployment, the pipeline requires additional approval before releasing to production. For package consumers, multi-approval workflows in deployment pipelines help ensure that if a malicious package passes initial scanning, human review can catch suspicious changes before production deployment. Artifact signing provides a complementary cryptographic layer that works alongside these process controls. The Shai-Hulud attack succeeded because compromised maintainer credentials allowed threat actors to publish malicious packages directly to the public npm registry. For package consumers, the defense is ensuring that packages pulled from public registries cannot reach production without verification. Artifact signing is one concrete implementation of this layered approach. By cryptographically binding a package or container image to the identity that produced it, signing creates a verification layer that is independent of the credential used to trigger the build—meaning a compromised developer credential alone isn’t sufficient to introduce an unverified artifact into your deployment pipeline. Artifact signing as part of defense in depth AWS Signer provides cryptographic signing for packages, creating an additional verification layer within your defense in depth strategy. The signing authorization model separates concerns: developer credentials shouldn’t have signing permissions. Only CI/CD pipeline roles should have signing permissions through the signer:StartSigningJob API. Signer uses FIPS 140-3 Level 3 validated hardware security modules (HSMs) to store signing keys, providing strong cryptographic protection. The container image signing workflow, shown in Figure 2, demonstrates how signing integrates seamlessly into existing processes: The developer or CI/CD pipeline builds a container image and pushes it to Amazon Elastic Container Registry (Amazon ECR) With Amazon ECR managed signing (new capability), Amazon ECR automatically triggers signing when the image is pushed Amazon ECR calls Signer with the image digest and signing profile Signer verifies the signing profile permissions and signs the image digest using keys stored in FIPS 140-3 Level 3 validated HSMs The signature is stored alongside the image in Amazon ECR using Open Container Initiative (OCI) artifact format At deployment time, admission controllers (Kyverno for Amazon Elastic Kubernetes Service (Amazon EKS)), lifecycle hooks for Amazon Elastic Container Service (Amazon ECS)) verify signatures before allowing deployment The benefits of Signer compared to building custom signing infrastructure include: Fully managed: No need to build custom signing infrastructure or manage certificate lifecycle Automated: Amazon ECR managed signing happens automatically on image push without manual steps Centralized governance: Single signing profile can be used across multiple accounts and pipelines Native integration: Built-in integration with Notation and Kyverno for signature verification in Amazon EKS FIPS 140-3 Level 3 compliance: Meets stringent regulatory requirements for cryptographic operations Audit logging for all signing operations enables detection of unusual patterns such as signing from new IP addresses, unusual times, or rapid succession of signing jobs. For every credential in your system, consider who can access what, how they prove their identity, and what second layer prevents sprawl if that credential is compromised. Artifact signing, combined with centralized storage and Software Bills of Materials (SBOMs), provides layered protection against tampering and malicious packages. Centralize dependency management By centralizing package and dependency management, you can validate and approve dependencies before they’re used in applications and quickly audit dependencies in the event of a supply chain security incident. Recent incidents have shown organizations discovering compromised npm packages in their internal artifact repositories, requiring rapid assessment of which applications might be affected. On AWS, you can use AWS CodeArtifact to host and manage your organization’s software packages. You can use the package group configuration to define an approved list of upstream sources and block access to all others—a direct control against typosquatting attacks, where malicious packages are published under names that closely resemble legitimate ones. Rather than relying on developers to identify suspicious package names at install time, package group configuration enforces the boundary at the repository level. Centralization also helps you pin versions of dependencies to prevent automatic updates from pulling in malicious versions and quickly remove compromised dependencies across your software portfolio when an incident occurs. For container images, Amazon ECR provides centralized image storage with AWS Key Management Service (AWS KMS) encryption and lifecycle policies. Combine Amazon ECR with Amazon Inspector scanning to continuously validate image integrity. For additional guidance see SEC11-BP05: Centralize services for packages and dependencies. npm provenance attestation For npm packages specifically, provenance attestations provide a complementary control on the consumer side. Available since npm 9.5, npm provenance links a published package to the specific source repository and CI/CD workflow that produced it, using Sigstore as the underlying signing infrastructure. When a package is installed, the npm CLI can verify that the published artifact matches the attested build provenance—providing confidence that the package wasn’t tampered with between build and publication. For organizations consuming open source npm packages, checking for provenance attestations before adding a new dependency is a low-friction signal of supply chain integrity. Package maintainers publishing to npm can enable provenance by running npm publish with the –provenance flag from a supported CI/CD environment such as GitHub Actions. For additional guidance see SEC11-BP06: Deploy software programatically and, from the DevOps Lens of the AWS Well-Architected Framework, DL.CS.2: Sign code artifacts after each build Scan dependencies throughout the software development lifecycle AWS provides services to help you scan dependencies continuously, from development through deployment: In development: Kiro can perform software composition analysis during code reviews to identify vulnerable third-party code. In code repositories and pipelines: Amazon Inspector scans first-party code, third-party dependencies, and Infrastructure as Code for vulnerabilities. For container images: Amazon Inspector provides continuous vulnerability scanning of Amazon ECR images. Amazon Inspector can also be integrated directly into CI/CD pipelines to scan images before they are pushed to Amazon ECR or deployed, helping you block compromised dependencies earlier in the release cycle. Traditional vulnerability scanners focus on known CVEs—publicly disclosed vulnerabilities with assigned identifiers. Supply chain attacks like Shai-Hulud involve malicious packages that function as zero-days: they’re intentionally crafted by threat actors and actively exploited before a CVE is assigned. Traditional vulnerability scanners that rely on CVE databases won’t detect these packages until they’ve been formally identified and catalogued, which can take days or weeks. Detecting these requires behavioral analysis at scale and community collaboration, not just static signature matching. The operational scale of AWS—with threat intelligence from sources like MadPot and incident response data across millions of customers—enables detection of suspicious package behavior across multiple environments simultaneously. When a newly published package exhibits credential-harvesting behavior in multiple customer accounts within hours of publication, that cross-account signal enables rapid identification. These findings are contributed to community-maintained databases like the OpenSSF Malicious Packages Repository (github.com/ossf/malicious-packages), which assigns a formal identifier (MAL-ID) and shares it across the security community. For the tea.xyz token farming campaign, the average time from submission to formal identification was approximately 30 minutes. AWS services like Amazon Inspector participate in this community loop, contributing findings and ingesting newly assigned MAL-IDs to surface threats in your environment. A related threat model worth understanding is the sleeper package: a package that appears benign at publication and activates malicious behavior only after a delay or trigger condition. Static analysis alone is insufficient to catch these packages because the malicious payload isn’t present or active at install time. Amazon Inspector behavioral analysis is specifically designed to detect this class of threat, complementing static vulnerability scanning. Software Bills of Materials (SBOMs) in SPDX or CycloneDX format enable you to quickly assess exposure during incidents. When responding to supply chain incidents, use SBOMs to identify which applications contain compromised packages, prioritize remediation, and assess blast radius. In the Shai-Hulud incident, the compromised packages (MAL-2025-46974 and CVE-2025-59144) were identified early, providing actionable findings that customers could remediate quickly. Organizations that had scanning enabled but experienced alert fatigue may have missed critical alerts, highlighting the importance of proper alert routing and prioritization. For additional guidance see SEC11-BP02: Automate testing throughout the development and release lifecycle. Configure logging and monitoring Visibility into activity is essential to detect anomalous behavior early. Configure logging and centralize those logs for analysis: Enable application and service logging Centralize and monitor logs across accounts Use GuardDuty to continuously monitor for malicious activity and anomalous API calls Aggregate findings with AWS Security Hub and enforce configuration best practices with AWS Config CloudTrail logging provides audit trails for credential access and API activity. When responding to supply chain incidents, review CloudTrail logs for specific events that indicate credential compromise or malicious activity: sts:AssumeRole calls from unexpected IP addresses or regions, secretsmanager:GetSecretValue or ssm:GetParameter calls from unfamiliar sources, ecr:PutImage from developer workstations bypassing CI/CD pipelines, lambda:UpdateFunctionCode outside normal deployment windows, iam:CreateAccessKey followed by immediate API activity, and codecommit:GitPush or codebuild:StartBuild from unusual IP addresses. When combined with Amazon EventBridge rules, you can trigger automated responses when Amazon Inspector detects malicious packages or when these unusual credential access patterns occur. Organizations affected by recent supply chain attacks have used CloudTrail analysis to determine the scope of credential exposure and identify which resources might have been accessed by compromised credentials. This forensic capability is essential for understanding blast radius and ensuring complete remediation. For additional guidance see the best practices in SEC04: Detection. These components of a defense in depth strategy work together to prevent sprawl after initial compromise and help you to detect and respond to the event. Figure 4. shows how these fit together. Additional best practices The Security pillar of the Well-Architected Framework also provides organizational best practices that are applicable to improving security processes across all dimensions of your organization. Relevant best practices include SEC11-BP01: Train for application security; SEC11-BP08: Build a program that embeds security ownership in workload teams; and SEC10: Incident Response. Conclusion Recent incidents including Shai-Hulud, Chalk/Debug, and tea.xyz reflect ongoing efforts by threat actors to target the the package registries, CI/CD pipelines, and developer credentials for increased attack surface and propagation. A single compromised maintainer account or malicious package can propagate across thousands of consumer environments simultaneously. The controls described in this post are designed with that threat model in mind. Temporary credentials limit the value of stolen tokens, centralized dependency management and upstream blocking reduce the attack surface at the registry level, artifact signing ensures that even if a build pipeline is compromised, unsigned artifacts cannot reach production, and dependency scanning throughout your software lifecycle helps you identify compromised packages early, before they can impact you. Each layer narrows the window of opportunity for a threat actor. Learn more See the following blogs and workshops to dive deeper on this topic: If you have feedback about this post, submit comments in the Comments section below.

この頃、セキュリティ界隈で 「Axios」にとどまらないオープンソース攻撃 信頼を悪用するだましの手口（1/2 ページ） オープンソースのJavaScript HTTPクライアント「Axios」に不正なコードが仕込まれたサプライチェーン攻撃。発端となったソーシャルエンジニアリングの手口が明らかになったことで、標的はAxiosにとどまらず、オープンソースエコシステムを狙った攻撃が他にも多発している実態が浮かび上がった。 Axiosのリードメンテナー、ジェイソン・サーイマン氏は事件後、巧妙な手口にだまされて遠隔操作マルウェアをインストールさせられたと告白していた。サプライチェーンのセキュリティ対策を手掛ける米Socketによると、Axiosの1件をきっかけに、オープンソースのJavaScript実行環境「Node.js」のエコシステムにかかわるメンテナーから、同じようなソーシャルエンジニアリング攻撃の標的にされたという報告が相次いでいる。 「信頼性が高く影響が大きいオープンソースのメンテナーを標的とする、組織的な大規模攻撃」が発生しているとSocketは見る。 同じ手口の攻撃が多発 Socketのフェロス・アブハディジェCEOも標的にされた一人だった。同氏は「WebTorrent」など何十億回もダウンロードされているnpmパッケージの開発者。ある日、「Openfort」という社名をかたる相手からSlackの招待メッセージが届き、「OpenfortとSocketのコラボレーションを模索したいと思っています。私たちの製品は非常に補完的です」とチャットに誘われた。 他にも同じようなメッセージを受け取ったSocketのエンジニアが何人もいることが分かった。声をかけられたのはいずれも、月に何十億回もダウンロードされているパッケージのメンテナーだった。 別の開発者のスコット・モット氏も、SocketのCEOに届いたのと同じ「Openfort」の社名を名乗る相手から、Slackへの招待メッセージが届いたことを明らかにした。モット氏は、Node.jsプロジェクトで広く使われているパッケージ「dotenv」の開発を手掛けている。 JavaScriptパッケージ「mocha」などのメンテナーであるペレ・ウェスマン氏も、Axiosの侵害事件の数週間前に、ほぼ同じような経験をしたと打ち明けた。 ウェスマン氏の場合、ポッドキャストの番組収録に招かれ、一緒にインタビューを受けるという数人と共にグループに追加された。準備のためと称する質問を受けた後、ストリーミングプラットフォームを偽装したWebサイト経由でビデオ通話に招待されたという。 ところが通話が始まると、もっともらしい技術エラーメッセージが表示され、解決のためと称してネイティブアプリのインストールを促された。しかし、ダウンロードしたアプリに情報を盗むマルウェアが仕込まれていることに気づいたウェスマン氏は、実行を思いとどまった。 すると相手はウェスマン氏のターミナルでcurlコマンドを実行させようとしたが、失敗するとその後連絡が途絶え、会話は全て削除されたという。 これとは別に、ウェスマン氏はOpenfortの創業者を名乗る相手から、LinkedIn経由でSlackの招待メッセージも受け取っていた。 Axiosのサーイマン氏に対して使われたのも、Slackワークスペースを悪用する手口だった。この時の相手もOpenfortの名をかたっていたという。 Copyright © ITmedia, Inc. All Rights Reserved. この頃、セキュリティ界隈で 海外のセキュリティ関連ニュースを追い続けている鈴木聖子さんによる、最近のセキュリティニュースブリーフィング。隔週でお届けします。

Aikido Security��Axios�̐Ǝ㐫�uCVE-2026-40175�v�͂��A�d��Ƃ��ꂽ�U���V�i���I�́uNode.js�v�̎d�l�ɂ���Đ������ɂ����Ǝw�E�����B���C�u�������̂̕s���͔F�߂Ă���A�C���łւ̍X�V�ȂǓK�ȑΉ������߂Ă���B ���̋L������������ł��B����o�^����ƑS�Ă������������܂��B �@Aikido Security��2026�N4��14���i���n���ԁj�AHTTP�N���C�A���g���C�u�����uAxios�v�Ɋւ���Ǝ�i�������Ⴍ�j���uCVE-2026-40175�v�ɂ��ĕ��͌��ʂ����\�����B���̐Ǝ㐫�͓����A�u�N���E�h���̊��S�N�Q�ɂȂ���\��������d��Ȗ��v�Ƃ��čL�����A�[���x�͍ő�l��10/10�iCritical�j�ɑ�������]�������B���������Ђ́A��ʓI�Ȏ��s���ɂ����Ă͍U�������̌��������Ⴂ�Ƃ̌������������B �@Axios�������ẮA�T�v���C��F�[���U���̉e����������ɂ��̐Ǝ㐫�����A�Z���ԂŒ��ڂ��W�܂����B�uAmazon Web Services�v�iAWS�j�F�؏��̐ގ��IMDSv2�iInstance Metadata Service v2�j�̉���A�܂��̓����[�g�R�[�h���s�ɂȂ���\�����w�E����Ă����B����Aikido Security�́A���������V�i���I���O��Ƃ���U���A���̐����������ڍׂɌ����A�����Ƃ̘����i������j���w�E���Ă���B �@���Ǝ㐫�́u�K�W�F�b�g��F�[���v�ƌĂ�镡���̎�_�̘A���Ɉˑ�����\�������B��̓I�ɊO���ˑ��W�ɂ�����v���g�^�C�v�������N�_�ɁAAxios���������ꂽ�l����荞�݁A�s����HTTP�w�b�_�����A���N�G�X�g�X�}�O�����O��SSRF���o�ăN���E�h�̃��^�f�[�^�T�[�r�X�փA�N�Z�X����Ƃ������ꂾ�B���̉ߒ���IMDSv2�̐����������A�ŏI�I�ɔF�؏����擾����\�������_�㎦����Ă����B �@���������̘A���́uNode.js�v���ɂ����đ����ɎՒf�����BAxios�͓�����Node.js��HTTP�N���C�A���g�@�\�𗘗p���Ă���A�w�b�_�ɕs���ȉ��s�R�[�h���܂߂鑀��̓����^�C�����Ō��o����A��O����������d�l�ƂȂ��Ă���B���̂��ߍU���̗v�ƂȂ�w�b�_�������������A�㑱�̍U���i�K�ɐi�߂Ȃ��B �@���̓_�ɂ��ẮA�Ǝ㐫����������Җ{�l�ƌ����Ȃ��ꂽ�BNode.js�ɉ����A�uBun�v��uDeno�v�Ƃ��������̎��s���ł����l�̐��m�F����Ă���A�W���I�ȍ\���ł͍U���͐������Ȃ��Ƃ̔F�������L���ꂽ�B���^�p���ɂ����Ă͌����I�ȋ��ЂƂ͌�����Ƃ̕]���ň�v���Ă���B �@�����ŁA�Ǝ㐫���̂��̂����݂��Ȃ��킯�ł͂Ȃ��BAxios�̃��C�u�����P�̂Ƃ��ẮA�s���ȃw�b�_�l�����e���Ă����_�����Ƃ���Ă���A���̋����͏C������Ă���B���s���̖h��Ɉˑ����Ă����v�͈��S���̊ϓ_������P���K�v�Ɣ��f���ꂽ�B �@��O�I�ȏ������ɂ����āA�U�������̉\�������S�ɂ͔ے�ł��Ȃ��BAxios�̓��N�G�X�g���M���@���J�X�^�}�C�Y�ł���d�g�݂�����Ă���A�J���҂��Ǝ��̃A�_�v�^�[����������HTTP�ʐM�ڏ�������ꍇ�A�����^�C���̌���������邱�Ƃ����_��\�ƂȂ�B���̂悤�Ȕ�W���I�ȍ\���ɂ����āA�w�b�_������������]�n�������邪�A�ʏ�̗��p�`�Ԃɂ͊Y�����Ȃ��B �@���ɒ��ڂ��W�߂�IMDSv2����ɂ��Ă��A�����I�Ȑ��������͌������B�U���҂̓v���g�^�C�v�����A�w�b�_������A�����T�[�r�X�ւ̓��B���A�����^�C������̉���Ƃ����������̏������ɖ������K�v������B����炪�S�Đ�������P�[�X�͌���I�ł���A��ʓI�Ȋ��ł͍Č�������Ƃ����B �@����̎���́A�Ǝ㐫�]���ɂ�����X�R�A�̉��߂ɏd�v�Ȏ�����^����B�ō��]���͗��_��ň��̃V�i���I��O��Ƃ��ĎZ�o����邱�Ƃ������A���ۂ̉^�p���ł̉e���x�����̂܂ܔ��f������̂ł͂Ȃ��B�����̑O��������d�˂����ʂƂ��č����]���ƂȂ�ꍇ�A�����I�ȍU���\���Ƃ̊Ԃɍ��������邱�Ƃ�����B �@�J���҂ɑ��A�ߓx�Ȍx���Ɖߏ��]���̂������������p�������߂���BAxios�͊��ɏC��������Ă���A�ŐV�łւ̍X�V����������Ă���B�܂��A�ˑ��W�ɂ�����v���g�^�C�v�����̗L���ASSRF�̘I�o�͈́A�����l�b�g���[�N�ւ̃A�N�Z�X����ȂǁA���ۂ̍U���ʂɊ�Â����m�F�����߂���BAikido Security�́A�Ǝ㐫����]������ۂɂ̓X�R�A�����łȂ��A�U��������������s���̖h��@�\�܂��������I�Ȕ��f���K�v�ł���Ƌ������Ă���B Copyright © ITmedia, Inc. All Rights Reserved.

Axios: disponibile PoC per lo sfruttamento della CVE-2026-40175 Alert AL02/260414/CSIRT-ITA Sintesi Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-40175 presente nella libreria Axios, client HTTP ampiamente utilizzato in applicazioni JavaScript per browser e ambienti Node.js, incluse architetture cloud e microservizi. Tipologia Authentication Bypass Remote Code Execution Descrizione e potenziali impatti Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE‑2026‑40175 - di tipo "Gadget‑based vulnerability" e con score CVSS 3.x pari a 10.0 – presente nella libreria Axios. Tale vulnerabilità è dovuta alla mancata sanitizzazione degli header HTTP nella costruzione delle richieste: durante il config merge, vengono infatti ereditate automaticamente le proprietà presenti sull’oggetto di configurazione, incluse quelle provenienti da Object.prototype. Sebbene Axios includa protezioni contro la Prototype Pollution diretta, la libreria rimane vulnerabile all’uso come gadget quando una vulnerabilità di Prototype Pollution è presente in una dipendenza terza (ad es. qs, minimist, body‑parser). Un attaccante remoto non autenticato può sfruttare la vulnerabilità tramite una exploit‑chain che combina Prototype Pollution in una dipendenza e HTTP Header Injection in Axios, ottenendo così l’accesso ai servizi di metadata cloud e la potenziale completa compromissione dell’infrastruttura. Prodotti e versioni affette Axios, versioni precedenti alla 1.15.0 Azioni di mitigazione Ove non provveduto, si raccomanda di aggiornare tempestivamente le release vulnerabili all’ultima versione stabile disponibile.

2026�N3��31���A���T��1���_�E�����[�h����Ă�����vHTTP�N���C�A���g���C�u�����uaxios�v�̎�v�J���҃A�J�E���g���������A�����C�u�����̈ˑ��W�Ƀ}���E�F�A���d���܂ꂽ���ӂ̂���o�[�W���������J���ꂽ�B�e���͈͂͑傫���A�N�Q�̑S�̑��ƑΉ��̎w�j��������GMO Flatt Security�̃u���O�L�������ڂ��W�߂��B�{�e�͓��ЂŋL�������M�����ē��M�u���ɃC���^�r���[�B�L���ł͏�����Ȃ��������M�҂Ƃ��Ă̎v���A�������u�\�t�g�E�F�A�T�v���C��F�[���U���v�̋��P�����B ���̋L���͉������ł��B����o�^�i�����j����ƑS�Ă������������܂��B �@2026�N3��31���i���{���ԁj�AOSS�i�I�[�v���\�[�X�\�t�g�E�F�A�j�G�R�V�X�e����k���i����j������\�t�g�E�F�A�T�v���C��F�[���U�������������B���T��1���_�E�����[�h����Ă�����v��HTTP�N���C�A���g���C�u�����uaxios�v�ɂ����Ď�v�J���ҁi���[�h�����e�i�[�j�̃A�J�E���g���������A�ˑ��W�Ƀ}���E�F�A���d���܂ꂽ���ӂ̂���o�[�W���������J���ꂽ�̂��B �@axios�́AWeb�u���E�U��Node.js��HTTP�ʐM�����邽�߂̃N���C�A���g���C�u�����B�͂ꂽ�V�X�e������ŐV��CLI�i�R�}���h���C���C���^�t�F�[�X�j�c�[���܂Ŏ��鏊�ɑg�ݍ��܂�Ă���B�J���҂�J������ɂƂ��Ă���u������O�v�̑��݂��B �@axios�̐N�Q�́A��v�J���҂����x�ȕW�I�^�\�[�V�����G���W�j�A�����O�̕W�I�ƂȂ�APC��������ꂽ���Ƃɒ[����B�U���҂͎��݂����Ƃ̑n�Ǝ҂��A�U��Slack���[�N�X�y�[�X�ɊJ���҂����҂��AMicrosoft Teams�ł̃I�����C���~�[�e�B���O��ݒ�B�~�[�e�B���O�̍ہA�u�������Â��悤���v�ƃA�b�v�f�[�g�𑣂����B�J���҂͐��K�̃A�b�v�f�[�g���Ǝv�����݁ARAT�iRemote Access Trojan�j���C���X�g�[�����Ă��܂����B �@�U���҂͊J���҂�PC������������A�ˑ��W�Ƀ}���E�F�A���d�����ӂ̂���o�[�W�����i1.14.1�����0.30.4�j���Anpm�Œ��ڌ��J�����B �@GMO Flatt Security�̕��͂ɂ��ƁA�C���X�g�[����Ɏ��g�̃X�N���v�g�Ȃǂ̍��Ղ����ȏ������邽�߁A�t�H���_���������Ă��N���[���Ɍ�����Ƃ����I���Ȏd�|�����{����Ă����Ƃ����B���ӂ̂���o�[�W������npm�ŘI�o���Ă������Ԃ͂��ꂼ���2����53���A��2����15���Ƃ����o�����ł���A�R�~���j�e�B�[�̐s�͂ɂ����J����Ԃ��Ȃ��������i�e�C�N�_�E���j���ꂽ�B �@���������܂œǂ�Łu�������g�̃v���W�F�N�g�ł͉e�����Ȃ�����������W�Ȃ����v�ƈ��S����IT�S���҂�����Ƃ���A����͔��Ɋ댯�ȏ�Ԃ�������Ȃ��B �@�{�e�́A�N�Q������ɂ��������uaxios �\�t�g�E�F�A�T�v���C��F�[���U���̊T�v�ƑΉ��w�j�v�����J����GMO Flatt Security�ŁA���L�������M�����ē��M�u���ɃC���^�r���[�B�L���ł͏�����Ȃ��������M�҂Ƃ��Ă̎v���A�������u�\�t�g�E�F�A�T�v���C��F�[���U���v�̋��P�����B �\�\�{���͂�낵�����肢���܂��Baxios�̐N�Q�ɂ��ďڍׂȑΉ��w�j�������������J���ꂽ�w�i�ɂ́A�ǂ̂悤�ȓ��@���������̂ł��傤���B �ē����@���͌��݁AGMO Flatt Security�Ŏ���В�Co-CTO�i�ō��Z�p�ӔC�ҁj�Ƃ��Čo�c�Ɍg���A2026�N1������\�t�g�E�F�A�T�v���C��F�[���Z�L�����e�B���Ƃ̐ӔC�҂��������Ă��܂��B�\�t�g�E�F�A�T�v���C��F�[��������ŐV�̋��Г����ɂ��ă��T�[�������A���q���܂Ƀ��|�[�e�B���O������A�ŐV�̋��Г������ǂ����Ђ̃v���_�N�g�ɗ��Ƃ�����ł����������������肵�Ă��܂��B�V�K���Ƃ𗧂��グ��ۂ͂����������g�Ŏ�����悤�ɂ��Ă���Aaxios�̐N�Q�Ⓖ�߂ŋN�����R���e�i�Ǝ�i�������Ⴍ�j���X�L���i�[�uTrivy�v�̐N�Q�i�֘A�L���j�ɂ��Ă��A�����g���������������ď����������������ł��B �\�\2026�N1���Ƀ\�t�g�E�F�A�T�v���C��F�[�����Ƃ𗧂��グ��ꂽ���̂��Ƃ������̂ł��ˁB2025�N�Ɋ������g�債�����ȑ��B�^���[���uShai Hulud�v�i�֘A�L���j���傫�Ȓ��ڂ��W�߂܂������A���̃^�C�~���O�ł̎��Ɖ��ƊW���Ă���̂ł��傤���B �ē����@2025�N��Shai Hulud�́A�U���҂ɂƂ��āu�ǂ��܂ł��邩�v�������U���������Ɗ����܂��B�����Ƃ��Ắu����ȍU�����ł���Ƃ������Ƃ́A�U���҂͂��ꂩ��U����{�i�������Ă��邾�낤�v�Ƃ��������Ă�����܂����B�����ŁA2025�N���ɎГ��Ɍ����āu2026�N�x�̓\�t�g�E�F�A�T�v���C��F�[�����ƂɎ��g��ł����v�|�����A���Ђ̊����ł���2026�N1���Ɏ��g�݂��n�߂����Aaxios�̐N�Q���N���Ă��܂����Ƃ����ł��B �\�\axios�̐N�Q�ɑ���Ή��w�j���܂Ƃ߂Ď��M���ꂽ�����̗����Ȉ�ۂƁA���̌�A��Q�ɑ�����axios�̎�v�J���҂�GitHub�Ŗ��������u�|�X�g���[�e���i����j�v�̓��e�������ɂȂ��āA���ƂƂ��Ă��̈�A�̐N�Q���ǂ��]������Ă��܂����B �ē����@�ŏ��Ɍ��|�����Ƃ��ɕ���������́u����͉e�����ł�������v�Ƃ������̂ł����Baxios�ڎg���Ă��Ȃ��Ă��A�ˑ��W�̂ǂ����ɕK�����݂��Ă���̂ł��B���Ђ̋��Ѓn���e�B���O�v���b�g�t�H�[���ł��A���E�I�ȑ��e�N�m���W�[��Ƃ�������̂��܂߁A���l�ȃp�b�P�[�W�̉�̓��O����u���m��ʒʐM�����ł���v�Ƃ����c��ȃA���[�g������Ă��܂����B�ʐM�������ǂ�Ƃ������axios�̈ˑ��W�Ɏd���܂ꂽ�}���E�F�A����ł���A���Ԃ̐[������Ɋ������̂ł��B �@�U���̎�����̂́A�Â����猩����u���C�t�T�C�N���X�N���v�g�ipostinstall�t�b�N�q���r�j�v���o�R�����U���ł���A�����ĖڐV�������̂ł͂���܂���B����̓p�b�P�[�W���C���X�g�[����������ɃX�N���v�g���������s�����d�g�݂����p�������̂ł��B�g���Â��ꂽ����ł���قlje���͈͂��傫���������Ƃ́A�����Z�L�����e�B�ƊE��JavaScript�̃G�R�V�X�e�������N�h����Ă��Ȃ������Ƃ������������炽�߂ē˂��t����ꂽ�ƁA�����Ɋ����܂����B �@���ׂĂ������Ŕ��������U���҂̃X�s�[�h���Ɨ��x�̌���ɂ��A������@�����o���܂����B�����ԂōU�����A�N�Q������݂ɏo���ƌ�������C2�iCommand and Control�j�T�[�o�̒ʐM�����ď؋��̉B�ł�}���Ă����̂ł��B �@����͂������3���Ԉȓ��Ɉ��ӂ̂���o�[�W�����������Ă���A�h�䑤�̐������������u�Ԃł�����܂����B�����A���ʂƂ��Ă͊m���Ɂu������v�ł����B�����J���҂����i�g���Ă���OSS�����ł��N�Q���ꂩ�˂Ȃ��Ƃ����O��ŁA���q����K�v�����鎞��ɓ˓����Ă��܂����Ɗ����Ă��܂��B ���Ғ��F axios�N�Q�ɂ����Ă�axios�̃\�[�X�R�[�h���̂͏����������Ă��炸�A�ˑ���Ƃ��Ēlj����ꂽ�����p�b�P�[�W�uplain-crypto-js�v��postinstall�t�b�N�ŌĂяo����A�������s�����d�|���ɂȂ��Ă����B�J���҂�����axios���C���X�g�[�����Ă��Ȃ��Ă��A�ʂ̃��C�u������R���|�[�l���g��axios�Ɉˑ��i�Ԑڈˑ��j���Ă���A�C�t���ʓ��Ƀ}���E�F�A���������s����郊�X�N���������B �\�\�|�X�g���[�e���ɂ��ƁA�J���҂�npm�̓�v�f�F�i2FA�j��L���ɂ��Ă��܂����B���݊�Ƃ��U�������U��Slack���[�N�X�y�[�X��Microsoft Teams��p�����I���ȃ\�[�V�����G���W�j�A�����O�ŊJ���҂�PC���̂�������A2FA�������I�ɖ��͉��i�I��j�������Ƃ����炩�ɂȂ��Ă��܂��B�J���҂�PC��_���ړI��_���Ƃ͉��ł��傤���B �ē����@�U���҂̍ŏI�ړI�́u�����i�}�l�^�C�Y�j�v�ł��傤�B����Anonymous�̂悤�ȃn�b�J�[�W�c���֎����Ă����悤�Ȗ����▼�_�ړI�ł͂Ȃ��A�����T���E�F�A�i�g��������^�}���E�F�A�j�ł��������̂悤�ɁA������Ίm���ɂ����ɂȂ鎞��ł��B�����A�N���f���V�����i�F�؏��j�𓐂�Ŕ��邾���̋��ЃA�N�^�[�ƁA������čU�����d�|���鋺�ЃA�N�^�[�����Ɖ�����Ă���A���h�ȃT�C�o�[�ƍ߂̃}�[�P�b�g���������Ă��܂��B �@���Ƃ�w�i�Ƃ���悤�ȋ��ЃA�N�^�[���̌n�����č������グ�A�O�݂��l�����邱�Ƃ��ړI�ɂȂ��Ă���A�u�ǂ������U���ł��܂����v�Ƃ����������́A���K�ړI�ōU�����d�|����̂��ړI���ƍl���܂��i���Ғ��Faxios�̎�v�J���҂�W�I�ɂ������ЃA�N�^�[�́u�k���N�ƊW�������́E�g�D�v�Ƃ������͂�����j�B �@���̏�ŁA�Ȃ��J���҂�PC���_����̂��B����͍U���҂ɂƂ��Ĕ��Ɂu�����I�v������ł��B�Ȍ��Ɍ����A�J���҂͊�ƂɂƂ��đ�ȃN���f���V�����������Ă���Ƃ������Ƃł��B���Ђ̓y�l�g���[�V�����e�X�g�i�N���e�X�g�j���Ƃ����Ă��܂����A�J���҂̊��͌��S�i����낤�j�ł͂Ȃ��ƁA���X�����Ă��܂��B �@�J���҂�PC�ɐN���ł���A�����Ă��X�e�[�W���O�����U���ł��܂����A�X�e�[�W���O���ɐN���ł���A�v���_�N�V���������U���ł���P�[�X������܂��B�J���n�ACI/CD�i�p���I�C���e�O���[�V�����^�p���I�f���o���[�j�c�[���܂ŐN���ł���ǂ��ɂ��Ȃ�Ƃ����̂͒���������܂���B �@��Ƃ̃r�W�l�X�����c�ƕ����1�l�_�������A�{�Ԋ���f�[�^�x�[�X�ŃN�G�������s�ł��錠�����������J���҂�1�l�_�������͂邩�Ɋm���ł��B������f�[�^���Í������Ă��Ă��A�N�G�������s�ł��錠��������f�[�^�������o���Ă��܂��B�܂�A��Ƃ̒��ł��ł����l�̂���f�[�^�ɋ߂��J���҂ڑ_���̂��U���Җڐ��Ō���Ɓu�����葁���v�̂ł��B �@�\�t�g�E�F�A�T�v���C��F�[���U���̓����Ƃ��Ă̈��|�I�ȃn�[�h���̒Ⴓ���J���҂��_���闝�R�ɋ�������ł��傤�B��Ƃ̒���SaaS�iSoftware as a Service�j�̗��p�\����������A��c����\���肷��ۂɂ͎Г��̏��F�v���Z�X��[��������͂��ł��B�������A�uOSS���C���X�g�[�����邱�Ɓv�Ɋւ��ẮA�N�̏��F����炸�ɑS�Ă̊J���҂����R�Ɏ��s�ł��Ă��܂��܂��B �@axios�̂悤�Ȗ��T��1������_�E�����[�h����钘���ȃp�b�P�[�W�̈ˑ��W�Ƀ}���E�F�A���d���ނ��Ƃ��ł���A�N�̏��F������Ȃ����h���ȓ������ʂ��āA�O���[�o���Ő����l�̊J���҂̒[���Ɉ�C�ɓ��B�ł��܂��B���̒��ɋ��Z�n�⍂�����������J���҂�1�l�ł�����U���҂ɂƂ��Ắu�听���v�Ƃ����킯�ł��B�U���҂ɂƂ��Ă���قǁu���������v�W�I�͂���܂���B �@�����炱���A�A�J�E���g��ID/�p�X���[�h��g�[�N���������s���|�C���g�Ŕ����̂ł͂Ȃ��APC�̑S������D���ɗ���̂ł��B���炩�ɂȂ���������̎����A�������̃p�b�P�[�W�����܂ł̑��x�͂��Ȃ��������Ă����ۂ��܂��B �@���̌����Ăł́A�U���҂̒��Ō��ʂ����؍ς݂́u�v���C�u�b�N�v�i�U���}�j���A���j���m������Ă��āA�ނ�ɂƂ��Ă��ł������I�Ȏ�@��W�I�ɉ����Ďg�������Ă���ƍl���܂��B �\�\���ӂ̂���o�[�W�����̘I�o���Ԃ͂������3���Ԗ����������Ƃ̂��Ƃł����A�U���҂ɂƂ��Ă͂��ꂾ���ł��\���Ȏ��ԂȂ̂ł��傤���B �ē����@�U���҂͒[��������������̍s���i�N���f���V�����̐ގ�Ȃǁj�����������ď������Ă����悤�ł��B����2�3�T�ԂɋN����Trivy�̐N�Q�����Ă��A�����Ԃ���u���̐N�Q�E�U���ɂȂ��邽�߂̃N���f���V�����v�͐ގ悳��Ă��܂��Ă��܂��B �@�I�o���Ԃ�2���Ԃ��낤��8���Ԃ��낤���A1�ł��d�v�ȃN���f���V�������R��Ă���Ό��ʂ͓����ł��B�����瑁�����͉����悤�Ƃ��A�N���������_�Ŗh�q���Ƃ��Ắu�����v�������Ƃ������Ƃ�F�����ׂ��ł��傤�B �\�\axios��Trivy�̐N�Q�Ƃ������\�t�g�E�F�A�T�v���C��F�[���U�����J���҂ɑ傫�ȏՌ���^���Ă��鍡�A���炽�߂Ăǂ̂悤�ȃ}�C���h�Z�b�g�����ׂ��ł��傤���B �ē����@�܂���O��Ƃ��āA�uaxios���g���Ă��Ȃ����v�͂قƂ�Ǒ��݂��Ȃ��ƍl����ׂ��ł��B���ڎg���Ă��Ȃ��Ă��ԐړI�Ɉˑ����Ă��܂��B������axios�̐N�Q�́A�P�Ȃ��̔�Q����ł͂Ȃ��A���m�̋��Ђ́u�Ăѐ��v���ƍl����ׂ��ł��B �@���߂́uSBOM�i�\�t�g�E�F�A���i�\�j�ȂǂŃ\�t�g�E�F�A�����Ɉˑ����Ă��邩�c�����܂��傤�v�Ƃ����i�K�ł������A���ꂩ��́u�ˑ��W������������ŁA�������̒m��Ȃ��p�b�P�[�W��{���Ɏg���Ă����̂��H�v��Y�܂Ȃ���Ȃ�Ȃ��t�F�[�Y�ɓ���܂����B �@��������Aaxios�N�Q�̉e�����Ă��܂����Ƃ��Ă��A�u�������������Ď�����C��t���悤�v�ŋ�����邩������܂���B�����A���ɂ܂��\�t�g�E�F�A�T�v���C��F�[���U�����N���āA�u����܂����A������͂��Ă��܂���ł����v�ł́A�ԈႢ�Ȃ��G���h���[�U�[����ӔC�����鎖�ԂɂȂ�ƍl���܂��B �@�@���̐��Ƃł͂Ȃ��̂Ōʋ�̓I�ȃR�����g�͍����T�������Ǝv���܂����A�ߋ��ɁuSQL�C���W�F�N�V�����v������Ă��Ȃ������J����Ђɑ��āA�����҂��疾������Ȃ��Ƃ��u���ƂƂ��ē��R�ʂ����ׂ�������v�Ƃ��ĐӔC����ꂽ�P�[�X������܂����B����Ɠ����悤�ɁA�����OSS�𗘗p�����Ƒ��ɂ���茵�����ڐ��ŐӔC������鎞��ɂȂ��Ă����Ƃ݂Ă��܂��B �@�J���҂͂���܂ňȏ�ɁAOSS���g�����Ƃ̃Z�L�����e�B���X�N�ɕq���ɂȂ�A��ƂƂ��Ă�OSS�̊Ǘ��̐���Z�L�����e�B�������\�t�g�E�F�A�J���̃X�^���_�[�h�Ƃ��Ď���Ă����K�v������܂��B �@�Ƃ͂����A����̃\�t�g�E�F�A�J���ɂ�����OSS���p�͔����Ēʂ�܂���B�J���҂��Ƃ̓��X�N�܂��Ȃ���i�߂Ȃ���Ȃ�Ȃ��A���ɂ���ǂ�����ɓ˓����Ă��܂��B �\�\axios�̐N�Q�̂悤�ɉe���͈͂��傫���N�Q���b��ɂȂ�ƁAOSS�̎g�p������������������AGitHub�̎g�p���֎~�����肷��Ƃ���������̊J���X�s�[�h�������Ȃ����˂Ȃ����[��������P�[�X�����O����܂��B����̊J���X�s�[�h���x�[�V�����Ȃ킸�ɁA�\�t�g�E�F�A�T�v���C��F�[���U������g�D������Ă������߂ɁA�u���ꂾ���͍ēx�_�����Ăق����v�u�J�����������ς��Ăق����v�Ƃ����_�͂���܂����B �ē����@�܂��O��Ƃ��āA�u���Y�p�b�P�[�W�ւ̈ˑ����Ȃ����ǂ������m�F����v�u�s�R�ȒʐM������Ă��Ȃ��������ǂ������m�F����v�Ƃ�����axios�N�Q�ɑ��钼�ړI�Ȋɘa��̎��{��Ή��̎w�j�ɂ��ẮA���Ђ��u���O�L���⑼�̃��f�B�A�Ȃǂł��L�����M����Ă���ʂ�ł��̂ŁA�܂��͂���������m�F�������������Ǝv���܂��B �@���̏�ŁA�u���O�ʼn���������e�ւ̃v���X�A���t�@�Ƃ��āA����̊F���܂ɍł������ӎ����Ă������������̂́A�u���i�Ǘ����Ă��Ȃ��G���h�|�C���g��_�����邱�Ɓv�ł��B �@�@�l��PC�[���ł���AEDR�iEndpoint Detection and Response�j�Ȃǂ̃Z�L�����e�B���i�������Ă�����ASOC�iSecurity Operation Center�j���[�����O���Ď��E�n���e�B���O���Ă���Ă����肷��P�[�X�������ł��傤�B �@����ŁAAmazon Web Services�iAWS�j��̉��z�}�V���iVM�j��T�[�o���X���i�i�uAWS Lambda�v�Ȃǁj�ɂ́A���������Z�L�����e�B���i�������Ă��炸�A�K�v�ȃe�����g���[��O������ĂȂ��P�[�X�����ɑ����̂ł��B�����炱���A��Ƃ��Ĉӎ����ׂ����Ƃ�����Ƃ���A�܂��́u�����Ă��Ȃ��Ƃ���i���p�j������v�Ƃ������Ƃ��F���܂Ɉ�Ԃɒ������ł��B �\�\�Ȃ�قǁB�u���Ă��Ȃ��Ƃ��������v�ƂȂ�ƁAVM��T�[�o���X���̑S�Ăɑ��āAPC�[���Ɠ����悤�ȃZ�L�����e�B���i�����ׂ��Ƃ������ƂɂȂ�̂ł��傤���B�����A����ł̓R�X�g�̑啝�ȑ�����������߁A��Ƃ̈ӎv����Ƃ��Ă͔��Ƀn�[�h����������ۂ��܂��B �ē����@���������ʂ�ł��B�����͖��m�Ƀo�����X�����K�v������܂��B �@���_���猾���A���Z�@�ւ̂悤�ɓ��i�̌������R���v���C�A���X�v�������߂�����������A�����^�C���̃��C���[�ōU�����Ւf�E�u���b�N����悤�ȃZ�L�����e�B���i���A�S�ẴT�[�o�ɖ����Ɏ����Ă����K�v�͂Ȃ��A�l�I�Ȕ����o�Ƃ��Ắu����Ȃ������v�ŏ\�����ƍl���Ă��܂��B�Ȃ��Ȃ�A�R�X�g�̖�肾���łȂ��A�v���_�N�V�������̃p�t�H�[�}���X�ɑ��Ă����e����^�����邽�߂ł��B �@�����ŁA�J���̃X�s�[�h��p�t�H�[�}���X�𗎂Ƃ��Ȃ����߂ɁA�����I�ɍŒ������Ăق�����Ƃ��āu�L���ɒ������邽�߂̃��O�i�l�b�g���[�N�̒ʐM���O��R�}���h���s���O�Ȃǁj���m���ɂƂ��Ă������Ɓv���������܂��B �\�\�u�Z�L�����e�B�C���V�f���g���N�����ہA���O���Ȃ���Ήe���͈͂��S��������Ȃ��v�Ƃ����̂̓����T���E�F�A�U���̔�Q����ł��ۑ�Ƃ��Ă悭�������Ă��܂��B�\�t�g�E�F�A�T�v���C��F�[���U���ɂ��ʂ���Z�L�����e�B��̊�{�Ƃ����킯�ł��ˁB �ē����@����ŁA�����ɂ̓v���_�N�V�������ł����������O������Ă��Ȃ��P�[�X���قƂ�ǂł��B��������S�����[�U�[��������K�͂�SaaS���ł́A�ʐM���O��S�ʊm�ۂ���̂��u�R�X�g�ʂŌ����I�ł͂Ȃ��v�Ƃ�����������ł��傤�B�S�ʊm�ۂ��{���ɑ�ςȂ��Ƃł���̂́A�����C�����Ƃ��Ēɂ��قǗ������Ă��܂��B �@�������A���̓\�t�g�E�F�A�T�v���C��F�[���U���̃��X�N�����ĂȂ��قǍ�����Ԃɂ���܂��B���O���S���Ȃ���A�u���Ђɉe�������������ǂ������ڋq�ɐ����ł��Ȃ��v�u�S���̃f�[�^�������ꂽ�Ƒz�肵�đΉ����邵���Ȃ��v�Ƃ����ň��̑Ή��Ɋׂ��Ă��܂��܂��B���O�����m�ۂ��Ă���Ήe���͈͂����m�ɂȂ�A��Q�ӏ�������ł��܂��B�u���������Ή����悤�v�Ɣ��f�ł���A���ʓI�ɗL���̍ۂ̑Ή��E�����R�X�g��啝�ɉ����邱�Ƃ��ł��܂��B �@���ꂩ��̃\�t�g�E�F�A�T�v���C��F�[���̋��ЂƐ키���߂ɕK�v�ȓ����Ƃ��Ċ����ׂ��^�C�~���O�ɗ��Ă���ƍl���܂��B �@���̏�ŁA�����Z�L�����e�B�\�Z��A�p�t�H�[�}���X�ւ̉e�����r�W�l�X�Ƃ��ċ��e�E�[���ł�����ł���A�ő���̑�Ƃ��āuCNAPP�iCloud Native Application Protection Platform�j�v�ƌĂ��悤�ȁA�N���E�h������邽�߂̃Z�L�����e�B���i�����A���m��u���b�N�̔\�͂����߂Ă����̂��|�C���g�ɂȂ�ƍl���܂��B �@��������Șb�ł����A�ꕔ���Z�n�̃Z�L�����e�B���A�Ȓ��n�K�C�h���C���ł́A�N���E�h�����܂ޑS�ẴT�[�o�ɃA����E�C���X��EDR�����邱�Ƃ���������t�����Ă���ꍇ������܂��B �@���ʂ̊�Ƃ��炷��Ɓu�����܂ł��́H�@�ߏ肶��Ȃ��H�v�Ǝv��ꂪ���ȃ|���V�[�ł����A�����g�A�����ȂƂ���i���Z���X�ł͂Ɗ����镔��������܂����B�������Aaxios�̐N�Q�ɂ����Ắu�e���̗L�����ォ�烍�O�Œǂ���v�Ƃ����_�ő傫�ȃA�h�o���e�[�W�錋�ʂƂȂ�܂����B�t�ɁA�����������|���V�[���Ȃ��N���E�h���^�p���Ă����i���O������Ă��Ȃ��j��Ƃ́u���Ђɉe�������������ǂ������������Ȃ��v�Ƃ����Ɋׂ��Ă��܂��Ă��܂��B �@���݂̃v���_�N�g�J�����́A����Ӗ��Łu�[���g���X�g�ȑO�v�̏�Ԃɋ߂��Ƃ����܂��B�u�J���҂�IT���e���V�[����������A�����������������Ă����Ă����v���낤�v�ƁA������D�悵�����ł��B �@�����炱���o�c�E�G�O�[�N�e�B�u�w�̕��X�ɂ͂��ЁA�J���X�s�[�h�ƃZ�L�����e�B�̃o�����X�����A�uCTO��PC���������Ă��A�܂��͊J���n�V�X�e���iCI/CD�Ȃǁj���N�Q����Ă��A�{�Ԋ���v���_�N�g�ɂ͒v���I�ȉe�����o�Ȃ��v�Ƃ������u�N�Q�����O��Ŕ�Q���ŏ�������V�X�e���v�⌠���̕����v�ւ̓�����i�߂Ă������������ł��ˁB �\�\�������_�͕ς��܂����A���߂�Microsoft��Mandiant�Ȃǂ̃��|�[�g�ł́u�����AI�i�l�H�m�\�j���g�����U�����嗬�ɂȂ�v�uAI�����ЂɂȂ�v�Ƃ������ʂ���\�����o�Ă��܂��B�\�t�g�E�F�A�T�v���C��F�[���U���ɂ����Ă��A���������uAI�̈��p�v�͉������Ă����Ǝ�������Ă��܂����B �ē����@����100�����̕����i�ނƊm�M���Ă��܂��B���ꂩ��̋��Ђ�����ŖY��Ă͂Ȃ�Ȃ��̂��A�܂���AI�̈��p�ł��B�U���҂�AI���g���ă}���E�F�A�쐬��U���̎����������낵���X�s�[�h�ʼn��������Ă��܂��BAnthropic�Ȃǂ�AI�J����Ƃ̓Z�[�t�e�B�i���S��j�̋�����ł��o���Ă͂��܂����A�Z�[�t�e�B�̌����Ă��Ȃ��ʂ�AI���f�������p����ɂ߂ėe�ՂɍU���ł��Ă��܂��̂������ł��B �@�܂�AI�ɃR�[�h����������u�o�C�u�R�[�f�B���O�v�����y���Ă���A�U���҂ɂƂ��Ċi�D�̕W�I�𑝂₷���ʂɂȂ����Ă��܂��Ă��܂��B�����܂��A�h�䑤��AI�Ȃǂ̋Z�p�����p���Ď����ł߂Ă����K�v������܂��B �@���Ђ́uTakumi byGMO�v�iTakumi Guard�@�\�j��npm��proxy�Ƃ��ē��삵�A���ӂ���p�b�P�[�W�����m�E�u���b�N���閳���̃T�[�r�X�ł��B�����ł́A���X���J�����c��Ȑ��̃p�b�P�[�W�ɑ��āA�y�l�g���[�V�����e�X�g�̒m�������l�ԂƓƎ��ɊJ������AI�uTakumi�v�̃n�C�u���b�h�̐��Ō������Ă��܂��B�����axios���Ăɓ��Ă͂߂�ƁA�ߑO11����ɂ͕��Б��Ńu���b�N�Ή����������Ă��܂����B�����p�b�P�[�W�������������܂ł̐����Ԃ̂����A��1.5���ԕ��́u�������郊�X�N�����v���Ƃ��ł��Ă����v�Z�ɂȂ�܂��B �@�h���ꂸ�Ƀ_�E�����[�h���Ă��܂����ꍇ�ł��A�ォ��u���Ȃ����Ǘ�������ň����p�b�P�[�W���_�E�����[�h����Ă��܂����v�ƒʒm����@�\������܂��B����ɂ��ASNS�ȂǂŘb��ɂȂ��Ă���Q�ĂĒ��ׂ�̂ł͂Ȃ��A���Ń��O�̒�����N���f���V�����̃��[�e�[�V�����Ȃǂ̏����Ή��Ɉڂ邱�Ƃ��ł��܂��B �\�\�Ō�ɁA�J���҂�Z�L�����e�B�S���҂Ɍ����ă��b�Z�[�W�����肢���܂��B �ē����@�����ċ��߂̌��t���g�킹�Ă��������܂����A����axios��Trivy�Ȃǒ��߂ŋN���Ă����A�̃\�t�g�E�F�A�T�v���C��F�[���U�����A�\�t�g�E�F�A�Y�ƂɂƂ��Ắu���\�L�̊�@�v���Ƒ����Ă��܂��B �@�\�t�g�E�F�A�Y�Ƃ́ALinux���܂߁A�J���ғ��m��OSS�����L���A���P�������Ƃ����f���炵���G�R�V�X�e�����撣���č��グ�Ă��܂����B�ߋ��ɂ��uXZ Utils�v�̂悤�ɁAOSS�Ƀo�b�N�h�A���d�|������P�[�X�͂���܂������A2026�N�ɓ����ċN���Ă����A�̍U���ɂ���āu������_���Ζ��m�ɋ��K����i�}�l�^�C�Y�ł���j�v�Ƃ����������A�U���҂ɒm��n���Ă��܂��܂����B����̓\�t�g�E�F�A�Y�ƂɂƂ��Ċ�@�I�ł��B �@����́A����ł���J���҂��AOSS���g����Ƃ���ۂƂȂ��āA���̃G�R�V�X�e��������Ă����K�v������܂��B�����������ŁA���Ђ����̈ꏕ�ƂȂ��悤�A�����������g��ł��������ł��B �\�\�{���͂��肪�Ƃ��������܂����B �@�{���ɋ��낵���͍̂����axios�̐N�Q���̂��̂ł͂Ȃ��A�u���Ђɂ͊W�Ȃ��������v�Ɩڂ�w���AOSS�Ƃ�������ȃG�R�V�X�e���̉��b������ɂƂǂ܂��Ƃ̎p����������Ȃ��B�J���X�s�[�h����̂��߂�OSS���p�ƁA�N�Q��O��Ƃ����Z�L�����e�B��ւ̓����̓Z�b�g�Ŏ��g�ނׂ��v���Ƃ�����B�ē������w�E����悤�ɁAOSS�Ɋւ��S�Ă̊�Ƃ������҂Ƃ��Č��������ׂ��������Ă���B Copyright © ITmedia, Inc. All Rights Reserved.

OpenAI is rotating potentially exposed macOS code-signing certificates after a GitHub Actions workflow executed a malicious Axios package during a recent supply chain attack. The company said that on March 31, 2026, the legitimate workflow downloaded and executed a compromised Axios package (version 1.14.1) that was used in attacks to deploy malware on devices. That workflow had access to code-signing certificates used to sign OpenAI's macOS apps, including ChatGPT Desktop, Codex, Codex CLI, and Atlas. While OpenAI says its investigation found no evidence that the signing certificate was compromised, the company is treating it as potentially compromised out of caution and is now revoking and rotating it. "Out of an abundance of caution we are taking steps to protect the process that certifies our macOS applications are legitimate OpenAI apps. We found no evidence that OpenAI user data was accessed, that our systems or intellectual property was compromised, or that our software was altered," explains an OpenAI security advisory. "We are updating our security certificates, which will require all macOS users to update their OpenAI apps to the latest versions." macOS users will need to update their apps to versions signed with the new certificate, as older versions may stop working on May 8, 2026. OpenAI worked with a third-party incident response firm to conduct an investigation, which found no evidence that the incident exposed its certificates or that they were used to distribute malicious software. The company also analyzed previous notarization activity linked to the certificate and confirmed that everything signed with it was legitimate. However, if the attacker obtained the certificate, they could use it to sign their own macOS applications that appear to be legitimately signed by OpenAI. Therefore, to reduce the risk, OpenAI says it is working with Apple to ensure no future software can be notarized with the previous certificate. OpenAI says that the certificate will be fully revoked on May 8, after which attempts to launch applications signed with it will be blocked by macOS protections. OpenAI says the issue is limited to its macOS applications and does not affect its web services or apps on iOS, Android, Windows, or Linux. It also says user accounts, passwords, and API keys were not impacted. Users are advised to update via in-app features or the official download pages, and to avoid installing software from links sent via email, ads, or third-party sites. The company says it will continue monitoring for any signs that the old certificate is being misused and may speed up the revocation timeline if anything suspicious is detected. The Axios supply chain attack has been linked to North Korean threat actors tracked as UNC1069, who conducted a social engineering campaign against one of the project's maintainers. After conducting a fake web conference call that led to the installation of malware, the threat actors gained access to the maintainer's account and published malicious versions of the Axios package to npm. This malicious package included a dependency that installed a remote access trojan (RAT) on macOS, Windows, and Linux systems. According to researchers, the attackers approached developers through convincing fake collaboration setups, including Slack workspaces and Microsoft Teams calls, eventually tricking them into installing malware that led to credential theft and downstream supply chain compromises. The activity has been linked to a larger campaign to compromise popular open-source projects for widespread supply chain attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

OpenAI revealed on Friday that it’s one of many organizations affected by the recent Axios supply chain attack, which cybersecurity experts have attributed to North Korean hackers. Axios is a widely used open source JavaScript HTTP client library for making requests in web and Node.js applications. It has over 100 million weekly downloads and is a dependency in countless developer projects and production systems. In late March, attackers compromised the NPM account of a lead Axios maintainer and published two malicious NPM packages designed to download and execute a cross-platform RAT capable of running on Windows, macOS, and Linux. The malicious packages were live for only a few hours before being detected and removed, but many organizations may have been affected. One of them is OpenAI, which detailed its investigation and remediation efforts, as well as its root cause analysis, in a blog post published on Friday. “A GitHub Actions workflow we use in the macOS app-signing process downloaded and executed a malicious version of Axios (version 1.14.1),” OpenAI explained. “This workflow had access to a certificate and notarization material used for signing macOS applications, including ChatGPT Desktop, Codex, Codex-cli, and Atlas. This certificate helps customers know that software comes from the legitimate developer, OpenAI.” The timing of the payload execution and other factors have led the AI giant to believe that the macOS signifying certificate has not been compromised. However, the company has decided to revoke and rotate the certificate as a precaution. If, however, the certificate was indeed compromised, the attacker could abuse it to sign malicious code and disguise it as legitimate OpenAI software. “We have stopped new software notarizations using the old certificate, so new software signed with the old certificate by an unauthorized third party would be blocked by default by macOS security protections unless a user explicitly bypasses them,” OpenAI said, adding, “Once we fully revoke our certificate on May 8th, 2026, new downloads and launches of apps signed with the previous certificate will be blocked by macOS security protections.” It’s unclear exactly how many Axios users were affected, but cybersecurity firm Huntress found evidence of compromise on 135 machines, and cloud security giant Wiz observed the malicious version executed in 3% of affected environments. While the access provided by the Axios supply chain attack may be useful for espionage, the North Korean threat group linked to the campaign, UNC1069, is primarily known for cryptocurrency theft and other money-making schemes. Related: CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads Related: Telnyx Targeted in Growing TeamPCP Supply Chain Attack Related: Guardarian Users Targeted With Malicious Strapi NPM Packages

OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user data or internal system was compromised. "Out of an abundance of caution, we are taking steps to protect the process that certifies our macOS applications are legitimate OpenAI apps," OpenAI said in a post last week. "We found no evidence that OpenAI user data was accessed, that our systems or intellectual property were compromised, or that our software was altered." The disclosure comes a little over a week after Google Threat Intelligence Group (GTIG) attributed the supply chain compromise of the popular npm package to a North Korean hacking group it tracks as UNC1069. The attack enabled the threat actors to hijack the package maintainer's npm account to push two poisoned versions 1.14.1 and 0.30.4 that came embedded with a malicious dependency named "plain-crypto-js," which deployed a cross-platform backdoor called WAVESHAPER.V2 to infect Windows, macOS, and Linux systems. The artificial intelligence (AI) company said a GitHub Actions workflow it uses as part of its macOS app-signing process downloaded and executed Axios version 1.14.1. The workflow, it added, had access to a certificate and notarization material used for signing ChatGPT Desktop, Codex, Codex CLI, and Atlas. "Our analysis of the incident concluded that the signing certificate present in this workflow was likely not successfully exfiltrated by the malicious payload due to the timing of the payload execution, certificate injection into the job, sequencing of the job itself, and other mitigating factors," the company said. Despite finding no evidence of data exfiltration, OpenAI said it's treating the certificate as compromised and that it's revoking and rotating it. As a result, older versions of all its macOS desktop apps will no longer receive updates or support starting May 8, 2026. This also means that apps signed with the previous certificate will be blocked by macOS security protections by default, preventing them from being downloaded or launched. The earliest releases signed with their updated certificate are listed below - ChatGPT Desktop - 1.2026.071 Codex App - 26.406.40811 Codex CLI - 0.119.0 Atlas - 1.2026.84.2 As part of its remediation efforts, OpenAI is also working with Apple to ensure software signed with the previous certificate cannot be newly notarized. The 30-day window till May 8, 2026, is a way to minimize user disruption and give them enough time to make sure they are updated to the latest version, it pointed out. "In the event that the certificate was successfully compromised by a malicious actor, they could use it to sign their own code, making it appear as legitimate OpenAI software," OpenAI said. "We have stopped new software notarizations using the old certificate, so new software signed with the old certificate by an unauthorized third-party would be blocked by default by macOS security protections unless a user explicitly bypasses them." Two Supply Chain Attacks Rock March The breach of Axios, one of the most widely used HTTP client libraries, was one of the two major supply chain attacks that took place in March aimed at the open-source ecosystem. The other incident targeted Trivy, a vulnerability scanner maintained by Aqua Security, resulting in cascading impacts across five ecosystems, affecting a number of other popular libraries depending on it. The attack, the work of a cybercriminal group called TeamPCP (aka UNC6780), deployed a credential stealer dubbed SANDCLOCK that facilitated the extraction of sensitive data from developer environments. Subsequently, the threat actors weaponized the stolen credentials to compromise npm packages and push a self-propagating worm named CanisterWorm. Days later, the crew used secrets pilfered from the Trivy intrusion to inject the same malware into two GitHub Actions workflows maintained by Checkmarx. The threat actors then followed it up by publishing malicious versions of LiteLLM and Telnyx to the Python Package Index (PyPI), both of which use Trivy in their CI/CD pipeline. "The Telnyx compromise indicates a continued change in the techniques used in TeamPCP's supply chain activity, with adjustments to tooling, delivery methods, and platform coverage," Trend Micro said in an analysis of the attack. "In just eight days, the actor has pivoted across security scanners, AI infrastructure, and now telecommunications tooling, evolving their delivery from inline Base64 to .pth auto-execution, and ultimately to split-file WAV steganography, while also expanding from Linux-only to dual-platform targeting with Windows persistence." On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection and extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework. Additional analyses of the campaign, now identified as CVE-2026-33634, have been published by various cybersecurity vendors - TeamPCP's supply chain compromise rampage may have come to an end, but the group has since shifted its focus towards monetizing existing credential harvests by teaming up with other financially motivated groups like Vect, LAPSUS$, and ShinyHunters. Evidence indicates that the threat actor has also launched a proprietary ransomware operation under the name CipherForce. These efforts have been complemented by TeamPCP's use of the stolen data to access cloud and software-as-a-service (SaaS) environments, marking a new-found escalation of the campaign. To that end, the cybercrime gang has been found to verify stolen credentials using TruffleHog, launch discovery operations within 24 hours of validation, exfiltrate more data, and attempt lateral movement to gain access to the broader network. "The credentials and secrets stolen in the supply chain compromises were quickly validated and used to explore victim environments and exfiltrate additional data," Wiz researchers said. "While the speed at which they were used suggests that it was the work of the same threat actors responsible for the supply chain operations, we are not able to rule out the secrets being shared with other groups and used by them." Attacks Ripple Through Dependencies Google has warned that "hundreds of thousands of stolen secrets" could potentially be circulating as a result of the Axios and Trivy breaches, fueling more software supply chain attacks, SaaS environment compromises, ransomware and extortion events, and cryptocurrency theft over the near term. Two organizations that have confirmed compromise through the Trivy supply chain attack are artificial intelligence (AI) data training startup Mercor and the European Commission. While the California-based company has not shared details on the impact, the LAPSUS$ extortion group listed Mercor on its leak site at the start of April, claiming to have exfiltrated about 4TB of data. The Mercor breach has led Meta to pause its work with the company, according to a report from WIRED. Earlier this month, CERT-EU revealed that the threat actors used the stolen AWS secret to exfiltrate data from the Commission's cloud environment. This included data relating to websites hosted for up to 71 clients of the Europa web hosting service and outbound email communications. The ShinyHunters group has since released the exfiltrated dataset publicly on its dark web leak site. GitGuardian's analysis of the Trivy and LiteLLM supply chain attacks and their spread through dependencies and automation pipelines has found that 474 public repositories executed malicious code from the compromised "trivy-action" workflow, and 1,750 Python packages were configured in a way that would automatically pull the poisoned versions. "TeamPCP is deliberately targeting security tools that run with elevated privileges by design. Compromising them gives the attacker access to some of the most sensitive environments in the organization, because security tools are typically granted broad access by design," Brett Leatherman, assistant director of Cyber Division at the U.S. Federal Bureau of Investigation (FBI), wrote on LinkedIn. The supply chain incidents are dangerous because they take aim at the inherent trust developers assume when downloading packages and dependencies from open-source repositories. "Trust was assumed where it should have been verified," Mark Lechner, chief information security officer at Docker, said. "The organizations that came through these incidents with minimal damage had already begun replacing implicit trust with explicit verification at every layer of their stack: verified base images instead of community pulls, pinned references instead of mutable tags, scoped and short-lived credentials instead of long-lived tokens, and sandboxed execution environments instead of wide-open CI runners." Both Docker and the Python Package Index (PyPI) maintainers have outlined a long list of recommendations that developers can implement to counter such attacks - Pin packages by digest or commit SHA instead of mutable tags. Use Docker Hardened Images (DHI). Enforce minimum release age settings to delay adoption of new versions for dependency updates. Treat every CI runner as a potential breach point and avoid pull_request_targe triggers in GitHub Actions unless absolutely necessary. Use short-lived, narrowly scoped credentials. Use an internal mirror or artifact proxy. Deploy canary tokens to get alerted to potential exfiltration attempts. Audit environment for hard-coded secrets. Run AI coding agents in sandboxed environments. Use trusted publishing to push packages to npm and PyPI. Secure the open-source development pipeline with two-factor authentication (2FA). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also added CVE-2026-33634 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that Federal Civilian Executive Branch (FCEB) agencies apply the necessary mitigations by April 9, 2026. "The number of recent software supply chain attacks is overwhelming," Charles Carmakal, chief technology officer of Mandiant Consulting at Google, said. "Defenders need to pay close attention to these campaigns. Enterprises should spin up dedicated projects to assess the existing impact, remediate, and harden against future attacks."

Disponibile PoC per lo sfruttamento della CVE-2025-62718 nella libreria Axios Alert AL08/260410/CSIRT-ITA Sintesi Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2025-62718 che interessa Axios, nota libreria client http per l'interoperabilità tra ambienti browser e Node.js. Tipologia Information Disclosure Spoofing Descrizione e potenziali impatti Nel dettaglio, la vulnerabilità identificata tramite la CVE-2025-62718, di tipo “Normalization Bypass” e con score CVSS v3.x pari a 9.3, è dovuta all’impossibilità da parte del software di normalizzare gli HOSTNAME prima del filtraggio NO_PROXY. Qualora sfruttata, tale vulnerabilità potrebbe permettere a un attaccante la possibilità di forzare l'applicazione a inviare richieste opportunamente predisposte da servizi interni che dovrebbero essere isolati, al fine di eludere i controlli perimetrali di sicurezza, carpire informazioni sensibili e facilitare l'interazione non autorizzata con infrastrutture critiche. Prodotti e versioni affette Axios versioni precedenti alla 1.12.2 Azioni di mitigazione Ove non provveduto, si raccomanda di aggiornare tempestivamente le release vulnerabili all’ultima versione stabile disponibile.

この頃、セキュリティ界隈で ダウンロード数1億超、人気ライブラリ「Axios」を襲ったサプライチェーン攻撃 発端は巧妙なアカウント乗っ取り オープンソースのJavaScript HTTPクライアント「Axios」に不正なコードを仕込んで流通させるサプライチェーン攻撃が発生した。米Microsoftや米Googleは、北朝鮮の集団が関与する極めて巧妙な攻撃だったと推測しており、影響の拡大が懸念されている。 AxiosはHTTPリクエストの簡略化に使われる人気JavaScriptライブラリで、週ごとのダウンロード件数は1億回以上。Axiosのリードメンテナー、ジェイソン・サーイマン氏によると、Axiosの不正なバージョン「1.14.1」および「0.30.4」がnpmレジストリに公開されたのは協定世界時の3月31日。いずれのバージョンにも「[email protected]」という不正な依存関係が仕込まれていて、macOSとWindows、Linuxに遠隔操作マルウェアをインストールさせる仕組みだった。 問題のバージョンは不正に気付いたAxiosコラボレーター（協力者）の通報を受け、リリースから約3時間後に削除された。 発端はサーイマン氏のアカウント乗っ取りだった。攻撃者は巧妙なソーシャルエンジニアリングの手口でサーイマン氏をだまして遠隔操作マルウェアをインストールするよう仕向け、PCに侵入してnpmアカウントの認証情報を入手。このアカウント経由で不正なバージョンのAxiosをリリースしていた。 こうした手口は、オープンソースのメンテナーを狙う攻撃パターンと酷似しているという。サーイマン氏は影響を受けた組織に対し、不正なバージョンを直ちに削除した上で、システムが侵害された可能性があると想定して対応するよう促している。 巧妙なだましの手口 サーイマン氏を狙ったソーシャルエンジニアリング攻撃は、2週間ほど前から始まったという。 攻撃者はある企業の創業者になりすましてサーイマン氏に接触し、巧妙に作り込まれたSlackワークスペースに招待。極めて説得力のある環境を整えてサーイマン氏を信用させ、Microsoft Teamsミーティングに誘った。 このミーティングの中で自分のシステムに古い部分があると言われたサーイマン氏は、Teams関連だと思って欠けている項目をインストールしたが、それが遠隔操作マルウェアだった。「何もかもがものすごくよくできていて、もっともらしかった。プロのやり方だった」とサーイマン氏は振り返る。 この振り返りに対し「自分にも数週間前に同じようなことがあった」というコメントも見られた。Googleは2月の時点で、同様のソーシャルエンジニアリングの手口について伝えていた。 さらなる攻撃を招く恐れも MS・Googleの分析 MicrosoftやGoogleの推測によると、今回のAxios攻撃を仕掛けたのは北朝鮮国家が関与する集団「Sapphire Sleet」（別名「UNC1069」）だった。 「今回の攻撃は、広く採用されているオープンソースフレームワークや配布チャネルを汚染して影響を拡大させるサプライチェーン攻撃のパターンを踏襲している」とMicrosoftは分析する。 Sapphire Sleetは2018年ごろから活動が確認されている北朝鮮の集団で、もうけを狙って暗号通貨ウォレットを盗んだり、暗号通貨取引やブロックチェーンプラットフォーム関連の技術や知的財産を標的にしたりしているという。 Axiosには他の人気パッケージも依存しており、影響は大きいとGoogleは推測する。しかもここ数週間で、別の集団もオープンソースを狙ったサプライチェーン攻撃を展開していることから、盗まれた機密情報が大量に出回っている可能性もある。そこからさらなるサプライチェーン攻撃やSaaS環境の侵害、ランサムウェア攻撃、暗号資産の窃盗などにつながる恐れもある。 守る側はそうした攻撃に細心の注意を払いながら、影響を見極めて侵害されたシステムを修復し、今後の攻撃に備えて一層守りを固める必要があるとGoogleは指摘している。 Copyright © ITmedia, Inc. All Rights Reserved. この頃、セキュリティ界隈で 海外のセキュリティ関連ニュースを追い続けている鈴木聖子さんによる、最近のセキュリティニュースブリーフィング。隔週でお届けします。

Secondo quanto riportato da Reuters, un gruppo di hacker legato alla Corea del Nord ha compromesso Axios, una libreria open source molto utilizzata per gestire le comunicazioni tra applicazioni web e servizi online, inserendo un codice malevolo all’interno di un aggiornamento distribuito agli utenti. L’operazione, individuata da Google e da ricercatori indipendenti, rientra nella categoria degli attacchi alla supply chain software e avrebbe potuto consentire il furto di dati e credenziali di accesso dai sistemi su cui la libreria era installata, aprendo la strada a ulteriori intrusioni. La particolarità dell’attacco risiede nella sua natura invisibile: non richiede, infatti, alcuna azione da parte dell’utente, ma sfrutta la fiducia riposta in un software largamente diffuso e utilizzato “dietro le quinte” da milioni di applicazioni. Secondo le analisi, il malware era progettato per funzionare su diversi sistemi operativi, inclusi Windows, macOS e Linux, e avrebbe potuto raggiungere un numero estremamente elevato di ambienti digitali, anche se non è stato chiarito quante installazioni siano state effettivamente compromesse. Indice degli argomenti Per comprendere meglio il contesto dell’attacco: Axios è un componente software utilizzato da sviluppatori e piattaforme per gestire le comunicazioni tra applicazioni e server, non un servizio visibile all’utente finale. In altre parole, si tratta di una di quelle tecnologie che operano in modo silenzioso e invisibile, ma senza le quali gran parte dei servizi digitali non funzionerebbe correttamente. È presente in applicazioni web, app mobili, servizi finanziari e piattaforme di e-commerce e proprio questa ubiquità lo rende un punto di osservazione privilegiato, ma anche un possibile punto di ingresso per operazioni malevole. Gli attaccanti sono riusciti stavolta a compromettere un aggiornamento del software, inserendo il codice dannoso all’interno di una versione distribuita agli utenti. Il codice, una volta installato, avrebbe potuto consentire l’accesso a dati sensibili, incluse credenziali di autenticazione, aprendo la strada a ulteriori attacchi. Un meccanismo semplice e, per questo, ancora più insidioso: il software, considerato affidabile, diventa esso stesso veicolo di compromissione. L’ attacco, non diretto a un’organizzazione specifica, è stato in grado di sfruttare un punto intermedio della filiera tecnologica, trasformando un elemento di fiducia in una vulnerabilità sistemica. La cyber security è spesso raccontata (e a ragione) attraverso la narrativa ricorrente dell’utente come anello debole della catena. Secondo questa consolidata impostazione, la maggior parte degli attacchi, si basa su errori umani, disattenzioni, clic su link malevoli o apertura di allegati compromessi. La difesa passa quindi, soprattutto, attraverso l’adeguata formazione e consapevolezza. L’attacco ad Axios rappresenta però una novità a questo assunto, poiché stavolta non è stato necessario alcun errore umano. Non c’è phishing, né social engineering, né interazione da parte dell’utente: il sistema viene compromesso attraverso un aggiornamento software legittimo, installato proprio perché ritenuto sicuro. Ciò significa che la vulnerabilità è al di fuori del comportamento dell’utente, poiché risiede nella struttura stessa dell’ecosistema digitale. La cosa maggiormente inquietante è il fatto che la fiducia, elemento indispensabile per il funzionamento delle tecnologie moderne, diventa un vettore di attacco: è il software che si è sempre utilizzato senza alcun sospetto a trasformarsi in un rischio. La sicurezza non può più quindi essere affrontata esclusivamente in termini di prevenzione degli errori umani e diventa necessario intervenire sulla qualità, sull’integrità e sulla tracciabilità della filiera software, dove le vulnerabilità possono propagarsi senza essere immediatamente visibili. L’evento che ha riguardato Axios mette in luce un aspetto spesso ignorato nel dibattito pubblico e, cioè, che internet, oltre che da piattaforme visibili e servizi digitali riconoscibili, è composto anche da una rete complessa di componenti software riutilizzabili, che costituiscono la vera infrastruttura logica del sistema. Librerie come Axios sono integrate in milioni di progetti e funzionano come elementi standardizzati che permettono agli sviluppatori di costruire applicazioni in modo più rapido ed efficiente. Una logica di riuso, alla base della scalabilità del digitale, che introduce però anche un elemento di dipendenza diffusa; quando una di queste componenti viene compromessa, l’effetto si estende potenzialmente a tutti i sistemi che la utilizzano. Si tratta di una forma di infrastruttura invisibile, che non è fatta di hardware o di reti fisiche, bensì di codice condiviso. Proprio perché invisibile, essa tende a sfuggire ai modelli tradizionali di controllo e regolazione; le organizzazioni spesso non hanno piena consapevolezza delle librerie integrate nei propri sistemi, né delle loro vulnerabilità. Attaccare questo livello significa operare in profondità, intervenendo su ciò che rende possibile il funzionamento dei servizi digitali, piuttosto che sui servizi stessi, e ciò amplia in modo significativo la superficie d’attacco. Gli attacchi alla supply chain rappresentano una delle evoluzioni più significative del panorama cyber contemporaneo: invece di colpire direttamente il bersaglio finale, l’attaccante interviene su un elemento intermedio della catena, sfruttando la fiducia che lega i diversi attori coinvolti. Nel caso del software, questa catena è particolarmente complessa e articolata, poiché ogni applicazione è costruita su una molteplicità di componenti, librerie e dipendenze, spesso provenienti da fonti diverse e aggiornate automaticamente. Da questo deriva un ecosistema interconnesso in cui la sicurezza di un singolo elemento può influenzare quella di molti altri. L’attacco ad Axios dimostra come un punto apparentemente secondario possa diventare strategico: attraverso la compromissione di una libreria ampiamente utilizzata, gli attaccanti ottengono un canale di distribuzione con una portata potenzialmente enorme. È la stessa diffusione del software a determinare l’ampiezza dell’impatto, senza che sia necessario identificare singoli target. Si tratta di una dinamica che introduce una nuova forma di rischio in cui la vulnerabilità è distribuita e non localizzata e le organizzazioni si trovano esposte sia per le proprie scelte tecnologiche che per quelle dei fornitori e della comunità open source su cui si basano. Il fatto che Axios sia un progetto open source aggiunge un ulteriore livello di complessità, dal momento che l’open source è uno dei pilastri su cui si fonda l’innovazione digitale contemporanea; permette collaborazione, trasparenza e condivisione, ed è utilizzato tanto da startup quanto da grandi multinazionali. Tuttavia, la sua diffusione ha superato la capacità di governance che lo caratterizza. Molti progetti open source sono mantenuti da piccoli gruppi di sviluppatori, spesso senza risorse adeguate a garantire livelli avanzati di sicurezza; allo stesso tempo, questi progetti vengono integrati in sistemi critici, creando una dipendenza strutturale. Se la natura aperta del codice consente da un lato una maggiore trasparenza e la possibilità di individuare vulnerabilità, dall’altro la mancanza di un controllo centralizzato e di obblighi normativi specifici può rendere più difficile prevenire e gestire attacchi complessi. Il problema è che l’open source viene trattato come un bene neutro, quando in realtà rappresenta una componente critica dell’infrastruttura digitale globale. Questa ambiguità si riflette anche sul piano giuridico, dove il ruolo e le responsabilità dei maintainer restano in gran parte indefiniti. L’attribuzione dell’attacco a un gruppo legato alla Corea del Nord consente di collocare l’evento in un contesto geopolitico più ampio. Negli ultimi anni, Pyongyang ha sviluppato infatti una strategia cyber sofisticata, utilizzando gruppi di hacker per condurre operazioni mirate al finanziamento del regime e al rafforzamento delle proprie capacità militari. A differenza di altri attori statali, la Corea del Nord ha fatto del cybercrime una componente strutturale della propria politica economica. Il furto di criptovalute, le intrusioni nei sistemi finanziari e gli attacchi alla supply chain rappresentano strumenti per aggirare le sanzioni internazionali e ottenere risorse difficilmente accessibili attraverso canali tradizionali. Gli attacchi alla supply chain software assumono quindi un valore strategico, perché consentono di massimizzare l’impatto con un investimento relativamente contenuto e di accedere a una molteplicità di target indiretti. Si tratta di operazioni che si collocano al confine tra criminalità e attività statale, rendendo più complessa anche la risposta sul piano giuridico e diplomatico. L’attacco ad Axios evidenzia un problema che il diritto fatica ancora ad affrontare e cioè la regolazione della supply chain software. In Europa, strumenti come la direttiva NIS2 e il Cyber Resilience Act rappresentano passi avanti importanti, anche se non risolvono completamente la questione. La difficoltà principale deriva dalla natura stessa del software, che è globale, distribuito e spesso sviluppato al di fuori di strutture organizzative tradizionali. I progetti open source, in particolare, sfuggono ai modelli classici di responsabilità, rendendo difficile individuare obblighi chiari e sanzioni applicabili. Gli attaccanti possono infatti operare senza vincoli territoriali e sfruttare le debolezze della filiera, mentre la regolazione resta ancorata a logiche nazionali o regionali, con una capacità limitata di intervento su fenomeni globali. Questa distanza tra tecnologia e diritto è in grado di amplificare le vulnerabilità, lasciando scoperti proprio quei livelli dell’infrastruttura digitale che risultano oggi più critici. Dall’attacco Axios emerge la necessità di un’evoluzione concettuale della sicurezza informatica: diventa infatti essenziale comprendere e gestire le dipendenze software su cui questi sistemi si basano. La complessità delle applicazioni moderne rende difficile avere una visione completa delle componenti utilizzate, ma senza questa visibilità è impossibile valutare correttamente il rischio. Strumenti come le Software Bill of Materials (elenchi strutturati che descrivono tutti i componenti e le dipendenze che compongono un software, rendendo finalmente visibile la filiera spesso opaca su cui si basa il funzionamento delle applicazioni digitali) rappresentano un tentativo di affrontare il problema, anche se la loro adozione è ancora limitata e non uniforme. La sicurezza deve necessariamente spostarsi da una logica difensiva a una logica di controllo attivo della filiera, impedendo le intrusioni e garantendo l’integrità dei componenti lungo tutto il ciclo di vita del software. Ciò richiede competenze, strumenti e modelli organizzativi nuovi, che però molte organizzazioni non hanno ancora sviluppato pienamente. L’attacco che ha coinvolto Axios rappresenta un cambiamento nel modo in cui le vulnerabilità vengono sfruttate e nel livello a cui gli attacchi si collocano. Inoltre, la fiducia, elemento fondamentale per il funzionamento dell’ecosistema digitale, emerge come uno dei punti più fragili. Quando il software considerato affidabile diventa un vettore di rischio, viene meno una delle basi su cui si costruisce la sicurezza. Per questo è necessario ripensare il rapporto tra tecnologia, governance e regolazione, riconoscendo il ruolo centrale della supply chain software e dell’open source e costruendo un modello in grado di garantire sicurezza senza compromettere l’innovazione. Sembra ormai indispensabile estendere i principi di responsabilità e controllo a un’infrastruttura che, pur essendo invisibile, è diventata essenziale per il funzionamento della società digitale.

Social engineering attacks on open source developers are escalating North Korean hackers spent weeks socially engineering an Axios maintainer through a fake Slack workspace, a cloned company identity, and a fabricated Microsoft Teams call that tricked him into installing a RAT posings as a software update. They used the access they gained to inject malware into npm packages downloaded 100+ million times a week. Now, a fresh Open Source Security Foundation (OpenSSF) advisory warns unknown attackers are using a similar approach to target other open source developers. The Axios attack was not isolated In the wake of the high-profile Axios compromise, Socket researchers learned that the same attack campaign targeted many other open source maintainers – particularly those managing Node.js and npm – as well as several Socket engineers. The attackers reach out via LinkedIn or Slack, posing as company owners/representatives, job recruiters, or podcast hosts, and tried to lure developers into downloading malware masquerading as a videoconferencing software update / fix. “The attackers used a spoofed Streamyard platform to trick Pelle Wessman, a maintainer of Mocha, into downloading a virus. Another expert, Matteo Collina, nearly fell for a Slack message on 2 April, while others like Scott Motte (creator of dotenv) and John-David Dalton (creator of Lodash) were also targeted,” Socket’s Deeba Ahmed shared. “They even went after Socket CEO Feross Aboukhadijeh, the creator of WebTorrent and buffer, who noted that this type of targeting is becoming the ‘new normal.'” Now someone is impersonating a Linux Foundation leader Christopher Robinson, OpenSSF’s Chief Technology Officer and Chief Security Architect, warns that attackers are currently also impersonating a well-known Linux Foundation community leader and attempting to lure the victim into following a malicious link. “The community has received reports of an active social engineering campaign targeting open source developers via Slack (including ToDoGroup and related communities),” he shared through the OpenSSF Siren List. The link provided by the attackers (https://sites.google.com/view/workspace-business/join) mimics a legitimate Google Workspace flow, but takes developers to a phishing page where they are asked to enter their login credentials and verification code, then install a fake root “Google certificate”. Developers using a Mac also apparently got an additional malicious binary dropped and executed via a script. “Installing the certificate enables interception of encrypted traffic and credential theft. Executing the binary may result in full system compromise,” Robinson noted. Don’t trust. Verify. As open source codebases have become harder to compromise directly, the attack surface has moved and the target, increasingly, is the person who ships the code. “Attackers are targeting developer workflows and trust relationships,” Robinson pointed out, and advised devs to verify the identities of those who reach out to them. “Do not trust messages based solely on name or profile, and confirm unusual requests through a separate, known communication channel. Be cautious of unsolicited outreach, even from familiar names,” he added. Developers should verify whether the login pages they are directed to are legitimate, avoid running software or scripts received via Slack or unknown websites, and be extra careful when faced with messages warning about expired certificates or urgent updates. Those who’ve fallen for the trick should consider their system, their credentials, and their active sessions and tokens compromised, and proceed to clean the former and rotate/revoke the latter. “Report the incident to your security team or organization,” Robinson also advised, and asked those who have observed similar activity or have additional indicators to share to report them to their security team and share them via appropriate community channels. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

L’operazione non è stata improvvisata. Gli aggressori hanno portato avanti una campagna mirata per settimane, basata su tecniche avanzate di ingegneria sociale. L’attacco cyber contro il software open source Axios, le cui presunte responsabilità sarebbero di hacker criminali nordcoreani ha evidenziato le crescenti vulnerabilità della comunità degli sviluppatori. Non si è trattato però di un’operazione lampo ma di una campagna di lungo periodo. Secondo le ricostruzioni, l’operazione non è stata improvvisata. “Gli aggressori hanno portato avanti una campagna mirata durata settimane, basata su tecniche avanzate di ingegneria sociale“. L’obiettivo, hanno sottolineato gli esperti cyber, “era conquistare la fiducia dello sviluppatore principale del progetto, Jason Saayman, per aumentare le probabilità di successo dell’attacco“. Ingannare con un ambiente credibile Lo stesso Saayman ha successivamente pubblicato un’analisi dettagliata dell’accaduto, spiegando che i primi tentativi di contatto risalgono a circa due settimane prima della compromissione (31 marzo). I cybercriminali, fingendosi una società reale, hanno costruito un ambiente credibile. “Un finto piano Slack apparentemente autentico e profili falsi di dipendenti per rafforzare la loro identità“. Il passo decisivo è arrivato con l’invito a una riunione online. Per partecipare, Saayman ha ricevuto la richiesta di scaricare un aggiornamento software che in realtà nascondeva un malware. Questa tecnica, “già osservata in precedenti attacchi attribuiti alla Corea del Nord“, consente agli hacker di ottenere accesso remoto ai sistemi delle vittime, spesso con l’obiettivo di rubare criptovalute. Una volta ottenuto il controllo del computer dello sviluppatore, gli aggressori hanno pubblicato versioni malevole del pacchetto Axios. Sebbene i due aggiornamenti compromessi siano stati rimossi entro circa tre ore dalla loro pubblicazione, si teme che in quel lasso di tempo migliaia di sistemi possano essere stati infettati. I rischi per i progetti open source Le conseguenze potenziali sono gravi. I dispositivi che hanno installato le versioni dannose potrebbero aver esposto chiavi private, credenziali e password, aprendo la porta a ulteriori violazioni. Questo episodio evidenzia una problematica sempre più rilevante. I progetti open source, spesso mantenuti da piccoli gruppi o singoli sviluppatori, rappresentano bersagli altamente strategici. “Comprometterli significa poter raggiungere, indirettamente, milioni di utenti e dispositivi in tutto il mondo“. Sono i crimini informatici una fonte di reddito per la Corea del Nord? Con particolare riferimento agli hacker nordcoreani, questi sono oggi considerati tra le minacce più attive nel panorama cyber globale, in relazione al contributo al reddito nazionale con i furti di criptovalute. “I gruppi di hacker criminali legati alla Corea del Nord hanno rubato più criptovalute di chiunque altro nel 2025. L’incasso totale si aggirerebbe sui 2 miliardi di dollari. Questa cifra ha rappresentato un aumento del 51% rispetto all’anno precedente. La fetta di asset digitali che hanno sottratto rappresenta il 60 per cento del totale dei furti a livello mondiale. Per una quota, pari a circa 3,4 miliardi di dollari nel 2025“. Su tale materia, l’Avvenire ha riportato alcune stime di un gruppo di esperti delle Nazioni Unite. Secondo loro – nel periodo che va dal 2017 al 2023 – la Corea del Nord avrebbe sottratto “asset virtuali per un valore di 3 miliardi di dollari tramite 58 attacchi informatici su piattaforme di criptovaluta“. L’obiettivo di queste operazioni cyber è spesso quello di ottenere risorse. Il tutto, sia per accrescere il bilancio statale che per aggirare le stesse sanzioni, finanziando il programma nucleare del Paese. In questi termini, il Governo del Paese asiatico ha iniziato a sviluppare moderne capacità informatiche già a metà degli anni ’90. Da allora, esistono diversi corsi di formazione informatica presso le università di Pyongyang, all’interno di un sistema di “addestramento” che dura anni. Investimenti sono arrivati anche nelle infrastrutture delle telecomunicazioni, sempre per massimizzare il suo potenziale informatico.

This week had real hits. The key software got tampered with. Active bugs showed up in the tools people use every day. Some attacks didn’t even need much effort because the path was already there. One weak spot now spreads wider than before. What starts small can reach a lot of systems fast. New bugs, faster use, less time to react. That’s this week. Read through it. ⚡ Threat of the Week Axios npm Package Compromised by N. Korean Hackers—Threat actors with ties to North Korea seized control of the npm account belonging to the lead maintainer of Axios, a popular npm package with nearly 100 million weekly downloads, to push malicious versions containing a cross-platform malware dubbed WAVESHAPER.V2. The activity has been attributed to a financially motivated threat actor known as UNC1069. The incident demonstrates how quickly the compromise of a popular npm package can have ripple effects through the ecosystem. The malware's self-deleting anti-forensic cleanup points to a deliberate, planned operation. "The build pipeline is becoming the new front line. Attackers know that if they can compromise the systems that build and distribute software, they can inherit trust at scale," Avital Harel, Security Researcher at Upwind, said. "That's what makes these attacks so dangerous -- they're not just targeting one application, they’re targeting the process behind many of them. Organizations should be looking much more closely at CI/CD systems, package dependencies, and developer environments, because that's increasingly where attackers are placing their bets." Ismael Valenzuela, vice president of Labs, Threat Research, and Intelligence at Arctic Wolf, said the Axios npm compromise reflects a broader trend where attackers infiltrate trusted, widely used software components to obtain access to downstream customers at scale. "Even though the malicious versions were available for only a few hours, Axios is so deeply embedded across enterprise applications that organizations may have unknowingly pulled the compromised code into their environments through build pipelines or downstream dependencies," Valenzuela added. "That downstream exposure is what makes these incidents particularly difficult to spot and contain, especially for teams that never directly chose to install Axios themselves. This incident reinforces that security teams need to treat build‑time tools and dependencies as part of the attack surface and not just trust tools by default." Inside the 2026 Cyber Workforce: Skills, Shortages, and Shifts in the Age of AI Insights to help leaders make informed decisions and show practitioners where careers are heading. Download Now ➝ 🔔 Top News Google Patches Actively Exploited Chrome 0-Day—Google released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild. The high-severity vulnerability, CVE-2026-5281 (CVSS score: N/A), concerns a use-after-free bug in Dawn, an open-source and cross-platform implementation of the WebGPU standard. Users are advised to update their Chrome browser to versions 146.0.7680.177/178 for Windows and Apple macOS, and 146.0.7680.177 for Linux. Google did not reveal how the vulnerability is being exploited and who is behind the exploitation effort. TrueConf 0-Day Exploited in Attacks Targeting Government Entities in Southeast Asia—Chinese hackers have exploited a zero-day vulnerability in the TrueConf video conferencing software in attacks against government entities in Southeast Asia. The exploited flaw, tracked as CVE-2026-3502 (CVSS score of 7.8), exists because of a lack of integrity checks when fetching application update code, allowing an attacker to distribute a tampered update. "The compromised TrueConf on-premises server was operated by the governmental IT department and served as a video conferencing platform for dozens of government entities across the country, which were all supplied with the same malicious update," Check Point said. The activity, which began in January 2026, involved the deployment of the Havoc framework. Most infections likely began with a link sent to the victims. TrueConf is used widely across organizations in Asia, Europe, and the Americas, serving about 100,000 organizations globally. Fortinet FortiClient EMS Flaw Under Attack—Fortinet released out-of-band patches for a critical security flaw impacting FortiClient EMS (CVE-2026-35616) that it said has been exploited in the wild. The vulnerability has been described as a pre-authentication API access bypass leading to privilege escalation. Exploitation efforts against CVE-2026-35616 were first recorded against its honeypots on March 31, 2026, per watchTowr. The development comes days after another recently patched, critical vulnerability in FortiClient EMS (CVE-2026-21643) came under active exploitation. Apple Backports DarkSword Fixes to More Devices—Apple expanded the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader range of devices to protect users from the risk posed by a recently disclosed exploit kit known as DarkSword. The update targets customers whose devices are capable of upgrading to the newest operating system (iOS 26), but have chosen to remain on iOS 18. Apple has taken the unprecedented step to counter risks posed by an exploit kit called DarkSword. The broader availability of the patches underscores the level of threat that malware like DarkSword poses. The fact that a large number of users were still using iOS 18, combined with the leak of a new version of DarkSword on GitHub, has pushed Apple towards releasing the fix so that they can stay protected without the need for updating to iOS 26. The leak is significant as it puts it within reach of less technically savvy cybercriminals out there. ClickFix Attack Leads to DeepLoad Malware—The ClickFix technique is being used to deliver a stealthy malware named DeepLoad that's capable of stealing credentials and intercepting browser interactions. The malware first emerged on a dark web cybercrime forum in early February 2026, when a threat actor, using the alias "MysteryHack," advertised it as a "centralized panel for multiple types of malware." According to ZeroFox, "DeepLoad's design is explicitly focused on actively facilitating real-time cryptocurrency theft, which almost certainly makes it an attractive malware suite in the cybercrime-as-a-service (CaaS) environment." The malware has since been distributed to Windows systems through ClickFix under the guise of resolving fake browser error messages. Besides stealing credentials, the malware drops a rogue browser extension to intercept sensitive data and spreads via removable USB drives. DeepLoad's actual attack logic is buried under layers of obfuscation, raising the possibility that some parts of the malware were developed using an artificial intelligence (AI) model. Claude Code Source Code Leaks—Anthropic acknowledged that internal code for its popular artificial intelligence (AI) coding assistant, Claude Code, had been inadvertently released due to a human error. Essentially, what happened was this: When Anthropic pushed out version 2.1.88 of its Claude Code npm package, it accidentally included a map file that exposed nearly 2,000 source code files and more than 512,000 lines of code. The source code leak has since revealed various features the company appears to be working on or that are built into the service, including an Undercover mode to hide AI authorship from contributions to public code repositories, a persistent background agent called KAIROS, combat distillation attacks, and active monitoring of words and phrases that show signs of user frustration. The leak also quickly escalated into a cybersecurity threat, as attackers pounced on the surge in interest to lure developers into downloading stealer malware. 🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-35616 (Fortinet FortiClient EMS), CVE-2026-20093 (Cisco Integrated Management Controller), CVE-2026-20160 (Cisco Smart Software Manager On-Prem), CVE-2026-5281 (Google Chrome), CVE-2026-3502 (TrueConf), CVE-2026-27876, CVE-2026-27880 (Grafana), CVE-2026-4789 (Kyverno), CVE-2026-2275, CVE-2026-2285, CVE-2026-2286, CVE-2026-2287 (CrewAI), CVE-2025-14819 (Notepad++), CVE-2026-34714, CVE-2026-34982 (Vim), CVE-2026-33660, CVE-2026-33696 (n8n), CVE-2026-25639 (Axios), CVE-2026-25075 (strongSwan), CVE-2026-34156 (NocoBase), CVE-2026-3308 (Artifex MuPDF), CVE-2026-1579 (PX4 Autopilot), CVE-2026-3991 (Symantec Data Loss Prevention Agent for Windows), CVE-2026-33026 (nginx-ui), CVE-2026-33416, CVE-2026-33636 (libpng), CVE-2026-3775, CVE-2026-3779 (Foxit PDF Editor), CVE-2026-34980, CVE-2026-34990 (CUPS), and CVE-2026-34121 (TP-Link). 🎥 Cybersecurity Webinars Learn How to Close Identity Gaps Using Insights from IT Leaders → Identity programs face rising risk from disconnected apps, manual credentials, and expanding AI access. Based on 2026 insights from 600+ IT and security leaders, this session shows what to measure, fix, and do now to close identity gaps and regain control. Learn How to Build Secure AI Agents Using Identity, Visibility, and Control → AI agents are already being used, but most teams don’t know how to secure them properly. This session shows a clear, practical way to do it using three key ideas: identity, visibility, and control.You will see what real deployment looks like, how to track what agents do, and how to manage their behavior safely.It also explains how to secure AI systems today without waiting for standards to settle. 📰 Around the Cyber World Device Code Phishing Attacks Surge —Device code phishing attacks, which abuse the OAuth device authorization grant flow to hijack accounts, have surged more than 37.5x this year. Push Security said it detected a 15x increase in device code phishing pages at the start of March 2026, indicating that the technique has finally entered mainstream adoption. "The technique tricks a user into issuing access tokens for an attacker-controlled application (not a device, confusingly)," the company said. "Any app that supports device code logins can be a target. Popular examples include Microsoft, Google, Salesforce, GitHub, and AWS. That said, Microsoft is, as always, much more heavily targeted at scale now than any other app." This has been fueled by the emergence of EvilTokens (aka ANTIBOT), the first reported criminal PhaaS (Phishing-as-a-Service) toolkit that supports device code pushing. EvilTokens features a Cloudflare Workers frontend and a Railway backend for authentication. Early iterations of the PhaaS kit emerged in January 2026. Another closed-source PhaaS kit called Venom offers device code phishing capabilities similar to EvilTokens. Some of the other PhaaS kits that have incorporated this technique include SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOW_TOKEN, PAPRIKA, DCSTATUS, and DOLCE. LinkedIn Comes Under Scanner for BrowserGate —A newly published report called BrowserGate alleged that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to scan visitors' browsers for thousands of installed Google Chrome extensions and collect device data without users' consent. "LinkedIn scans for over 200 products that directly compete with its own sales tools, including Apollo, Lusha, and ZoomInfo," the report said. "Because LinkedIn knows each user’s employer, it can map which companies use which competitor products. It is extracting the customer lists of thousands of software companies from their users' browsers without anyone's knowledge. Then it uses what it finds. LinkedIn has already sent enforcement threats to users of third-party tools, using data obtained through this covert scanning to identify its targets." The report also claimed LinkedIn loads an invisible tracking pixel from HUMAN Security, along with a separate fingerprinting script that runs from LinkedIn's servers and a third script from Google that runs silently on every page load. In response to the findings, LinkedIn told Bleeping Computer it scans for certain extensions that scrape data without members' consent in violation of its terms of service. The company also claimed the report is from an individual who is "subject to an account restriction for scraping and other violations of LinkedIn's Terms of Service." ICE Confirms Use of Paragon Spyware —The U.S. Immigration and Customs Enforcement (ICE) confirmed it uses spyware developed by Paragon to "identify, disrupt, and dismantle Foreign Terrorist Organizations, addressing the escalating fentanyl epidemic and safeguarding national security." Paragon's Graphite spyware has been found on the phones of journalists. WhatsApp last year said it disrupted a campaign that deployed the spyware against its users. The governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are suspected to be customers of the Israeli company. Ex-Engineer Pleads Guilty to Extortion Campaign —Daniel Rhyne, 59, of Kansas City, Missouri, pleaded guilty to a failed data extortion campaign that targeted his former employer. Rhyne was arrested in September 2024. According to court documents, Rhyne worked as a core infrastructure engineer at a U.S.-based industrial company headquartered in New Jersey. In November 2023, the defendant executed a ransomware attack against the company and sent an extortion email to its employees, threatening to continue shutting down the firm's servers unless he was paid about 20 Bitcoin, which was valued at $750,000 at the time. Last month, the U.S. Justice Department (DoJ) announced the conviction of Cameron Curry (aka Loot), a 27-year-old from Charlotte, North Carolina, for carrying out a cyber extortion scheme against a D.C.-based international technology company called Brightly Software. "Trial evidence established that Curry misused his position to access the victim company's personnel and other sensitive corporate records, which he then used to carry out the cyber extortion scheme after he learned that his contract was not going to be renewed and that he would no longer be employed by the company," the DoJ said. Between December 11, 2023, and January 24, 2024, Curry sent more than 60 emails to company executives and employees, stating he would disclose sensitive information unless he was paid $2.5 million in cryptocurrency. Brightly ended up paying $7,540 in Bitcoin. Residential Proxies Bypass Reputation Systems —Threat intelligence firm GreyNoise's analysis of 4 billion sessions targeting the edge over a 90-day period from November 29, 2025, to February 27, 2026, found that 39% of unique IP addresses targeting the edge originated from home internet connections, and that 78% vanish before any reputation system can flag them. "78% of residential IPs appear in only 1–2 sessions and are never observed again," it said. "IP reputation is structurally broken against residential proxies. The rotation rate exceeds the update cycle of any feed-based defense." This behavior also makes source IPs indistinguishable from a legitimate user's connection. The data also showed that 0.1% of residential sessions carry exploitation payloads, in contrast to 1.0% from hosting infrastructure, indicating that they are primarily used for network scanning and reconnaissance. The residential proxy traffic is generated by IoT botnets and infected computers, with the networks also resilient against takedown efforts. "After IPIDEA lost 40% of its nodes, operators backfilled within weeks," GreyNoise said. "Every major takedown produces the same result -- temporary disruption, then regeneration." The company also recommended that "Detection must shift from 'where is the traffic from?' to 'what is the traffic doing?" Device fingerprinting provides more durable detection because fingerprints survive IP rotation." Suspected N. Korea Campaign Targets Cryptocurrency Companies Using React2Shell —A new campaign has been observed systematically compromising cryptocurrency organizations by exploiting web application vulnerabilities such as React2Shell (CVE-2025-55182), pillaging AWS tenants with valid credentials, and exfiltrating proprietary exchange software containing hardcoded secrets. "Their targeting spans the crypto supply chain, from staking platforms, to exchange software providers, to the exchanges themselves," Ctrl-Alt-Intel said. The threat intelligence firm has assessed the activity with moderate confidence to be aligned with North Korean cryptocurrency theft operations. India Extends SIM-Binding Mandate —The Indian government has extended its SIM-binding mandate through December 31, 2026, while shelving plans to require messaging apps to forcibly log out web-based sessions like WhatsApp Web every six hours. The decision comes after the Broadband India Forum, which represents Meta and Google, warned the Department of Telecommunications (DoT) that the directions were unconstitutional. Under the framework announced in November 2025, a messaging app account would be tied exclusively to the physical SIM card during registration. This meant that the users could access the messages and other content only when that SIM is present in the device. Companies were given 90 days (i.e., until the end of February 2026) to comply. While SIM binding has been proposed as a way to combat spammers and conduct cross‑border fraud, the move has raised feasibility and user experience concerns. According to Moneycontrol, WhatsApp is said to be beta testing SIM binding on Android. Russian Threat Actors Looking to Regain Access Through Compromised Infrastructure —Russian threat actors like APT28 and Void Blizzard are attempting to regain access to computer systems they previously compromised to check if access is still available and whether the obtained credentials remain valid, CERT-UA has warned. "Unfortunately, these attempts sometimes succeed if the root cause of the initial incident has not been completely eliminated," the agency said. OkCupid Settles with FTC for Privacy Violations —OkCupid and its owner, Match Group, reached a settlement with the U.S. Federal Trade Commission over allegations that it did not inform its customers that nearly three million user photos were shared with Clarifai, a company that develops AI systems to identify and analyze images and videos. The complaint also accused the dating site of sharing users' location information and other details without their consent. As part of the settlement, OkCupid and Match did not admit or deny the allegations but agreed to a permanent prohibition that prevents them from misrepresenting how they use and share personal data. New Android Malware Mirax Advertised —A sophisticated new Android banking trojan named Mirax is being advertised as a private malware-as-a-service (MaaS) offering for up to $2,500 per month. The malware enables customers to gain remote control over devices and includes specialized overlays for more than 700 different financial applications to steal credentials and other sensitive information. It can also capture keystrokes, intercept SMS messages, record lock screen patterns, and use the infected device as a SOCKS5 proxy. Venom Stealer Spreads via ClickFix —A new malware-as-a-service (MaaS) platform dubbed Venom Stealer is being sold on cybercrime forums as a subscription ($250/month to $1,800 for lifetime access). It's marketed as "the Apex Predator of Wallet Extraction." Unlike other stealers, it automates credential theft and enables continuous data exfiltration. "It builds ClickFix social engineering directly into the operator panel, automates every step after initial access, and creates a continuous exfiltration pipeline that does not end when the initial payload finishes running," BlackFog said. The development coincides with a new ClickFix variant that replaces PowerShell with a "rundll32.exe" command to download a DLL from an attacker-controlled WebDAV resource. The attack leads to the execution of a secondary loader called SkimokKeep, which then downloads additional payloads, while incorporating anti-sandboxing and anti-debugging mechanisms. In the meantime, recent ClickFix campaigns have also leveraged searches for installation tutorials for OpenClaw, Claude, and other AI tools, as well as for common macOS issues to push stealer malware like MacSync. More Information Stealers Spotted —Speaking of stealers, recent campaigns have also been observed using procurement-themed email lures and fake Homebrew install guides served via sponsored search results to deliver Phantom Stealer and SHub Stealer. Some other newly discovered infostealer malware families include Storm, MioLab, and Torg Grabber. In a related development, CyberProof said it observed a surge in PXA Stealer activity targeting global financial institutions during Q1 2026. Another malware that has gained notoriety is BlankGrabber, which is distributed through social engineering and phishing campaigns. Data gathered by Flare shows that a single stealer log can be devastating, with individual logs containing up to 1,381 pieces of personally identifiable information. In an analysis published by Whiteintel last month, the company found that a single careless download of cracked software by one employee can hand criminal groups direct access to an entire corporate network in under two days. "An employee downloads cracked software on Tuesday afternoon," it said. "By Thursday morning, their credentials are listed on the Russian Market for $15. Corporate VPN access, AWS credentials, session tokens that bypass MFA – all packaged and ready for purchase." Phishing Campaign Targets Philippine Banking Users —An ongoing phishing campaign targeting major banks in the Philippines is using email phishing via compromised accounts as the initial vector to harvest online banking credentials and one-time passwords (OTPs) for financial fraud. According to Group-IB, the campaign began in early 2024, distributing over 900 malicious links as part of the coordinated scheme. Clicking on the link embedded in the email message triggers a redirection chain that uses trusted services like Google Business, AMP CDN, Cloudflare Workers, and URL shorteners before taking the victims to the final landing page. "The campaign enables real-time financial fraud by bypassing MFA mechanisms through the theft of valid One-Time Passwords (OTP), allowing attackers to perform unauthorized fund transfers," the company said. "Telegram bots were used as exfiltration channels, enabling threat actors to automatically collect victims' login information in real time." The activity has been attributed to a threat group called PHISLES. Chrome Extensions Harvests ChatGPT Conversations —A malicious Chrome extension, named "ChatGPT Ad Blocker" (ID: ipmmidjikiklckbngllogmggoofbhjikgb), found on the Chrome Web Store masquerades as an ad-blocking tool for the AI chatbot, but contains functionality to "steal the user's ChatGPT conversations data by systematically copying the HTML page and sending to it to a webhook on a private Discord channel," DomainTools said. Iran Conflict Triggers Espionage Activity in Middle East —In the aftermath of the U.S.-Israel-Iran conflict, Proofpoint said it has recorded an increase in campaigns from state-sponsored threat actors likely affiliated with China (UNK_InnerAmbush, which uses phishing emails to deliver Cobalt Strike payload), Belarus (TA473, which has used HTML attachments in emails for reconnaissance), Pakistan (UNK_RobotDreams, which has sent spear-phishing emails to India-based offices of Middle East government entities to deliver a Rust backdoor), and Hamas (TA402, which has used compromised Iraq government email addresses to conduct Microsoft account credential harvesting) targeting Middle East government organizations. The enterprise security company said it also identified the Charming Kitten actor targeting a think tank in the U.S. to trick recipients into entering their Microsoft account credentials. One activity cluster that remains unattributed is UNK_NightOwl. The email messages include a domain that spoofed Microsoft OneDrive, leading the victim to a credential harvesting page. If the user enters credentials and clicks the sign-in button, the target is redirected to "hxxps://iran.liveuamap[.]com/," a legitimate open-source platform called Liveuamap with news updates on the Middle East conflict. U.K. Warns of Messaging App Targeting —The U.K. National Cyber Security Centre (NCSC) became the latest cybersecurity agency to warn of malicious activity from messaging apps like WhatsApp, Messenger, and Signal, where threat actors could trick high-risk individuals into sharing their login or account recovery codes, or linking an attacker-controlled device under their accounts. 🔧 Cybersecurity Tools Dev Machine Guard → It is an open-source script that scans a developer machine to list installed tools and detect security risks across IDEs, AI agents, extensions, and configurations, without accessing source code or secrets, helping expose gaps traditional tools miss in developer environments. Pius → It is an open-source tool that maps a company’s external attack surface by discovering and cataloging internet-facing assets, helping security teams identify exposure and reconnaissance risks that could be targeted by attackers. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion The lesson is simple. Small things matter. Most issues now start from normal parts of the system, not big, obvious gaps. Don’t trust anything just because it looks routine. Updates, tools, and background systems can all be used in the wrong way. If it seems low risk, check it again. That’s where the problems are starting now.

The North Korean threat actor blamed for the Axios supply chain attack has been aiming its social engineering campaign at various Node.js maintainers, Socket reports. The Axios attack occurred on March 31, when two malicious package versions were published to the NPM registry. They were removed roughly three hours later, but were likely installed by over 3 million users. In a postmortem, Axios lead maintainer Jason Saayman explained that the hackers had infected his computer with a backdoor roughly two weeks before. The attackers used social engineering tactics previously observed in the DeceptiveDevelopment, Operation Dream Job, Contagious Interview, and ClickFake Interview campaigns. After inviting Saayman to a Slack workspace, the hackers scheduled a meeting on Microsoft Teams. When joining the meeting, the maintainer received an error message and was instructed to install a fake update that infected his system with the RAT. UNC1069, the North Korean hacking group blamed for the Axios supply chain attack, is now using similar social engineering tactics in a campaign targeting multiple high-profile Node.js maintainers. The attacks were aimed at Socket CEO Feross Aboukhadijeh, several Socket engineers, Node Package Maintenance Working Group member Wes Todd, Platformatic co-founder and CTO Matteo Collina, Dotenv creator Scott Motte, Node.js Security Working Group contributor Ulises Gascón, and others. The targeted individuals, Socket explains, maintain hundreds of NPM packages that have billions of downloads. All reported a similar social engineering attack as Saayman. The campaign was likely mounted over the course of several weeks, with great attention to detail, to make the lures as convincing as possible. The attackers built seemingly legitimate meeting infrastructure and established trust before tricking the intended victims into executing malware. “The operation takes weeks to execute and is deliberately designed to feel unremarkable. Attackers build rapport over time, schedule calls in advance and reschedule them, and conduct themselves with the professionalism of a legitimate business contact,” Socket notes. In February, Google warned that UNC1069 had been using the same tactics in attacks targeting DeFi companies, cryptocurrency entities, and venture capital firms. “I strongly recommend that the OSS maintainer community takes this very seriously. The specific personas and channels used for this attack are being investigated and taken down. But there are more. So many more. Report them. Talk about them. Share them. This is not your typical phishing,” security researcher Tay commented in the Axios postmortem thread. Related: North Korean Hackers Drain $285 Million From Drift in 10 Seconds Related: Polyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea

Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Financial groups lay out a plan to fight AI identity attacks Generative AI tools have brought the cost of deepfake production low enough that criminals and state-sponsored actors now use them routinely against financial institutions. A joint paper from the American Bankers Association, the Better Identity Coalition, and the Financial Services Sector Coordinating Council lays out the scale of the problem and calls on federal and state policymakers to act across various areas. Mimecast makes enterprise email security deployable in minutes Ranjan Singh, Chief Product and Technology Officer at Mimecast, outlines how the company’s API-based approach delivers protection on par with a traditional Secure Email Gateway without requiring infrastructure changes, and why that matters for stretched security teams trying to close detection gaps on BEC and credential phishing. Trust, friction, and ROI: A CISO’s take on making security work for the business In this Help Net Security interview, John O’Rourke, CISO at PPG, talks about what it means for security to drive business value. He explains how mature security programs reduce friction in sales cycles and M&A processes, and how trust is built over time. Axios npm packages backdoored in supply chain attack An unknown attacker has compromised the GitHub and npm accounts of the main developer of Axios, a widely used HTTP client library, and published npm packages backdoored with a malicious dependency that triggered the installation of droppers and remote access trojans. Software supply chain hacks trigger wave of intrusions, data theft After linking the Axios npm supply chain attack to North Korean hackers, Google researchers warned that “hundreds of thousands of stolen secrets could potentially be circulating” as a result of this and the Trivy, KICS, LiteLLM, and Telnyx supply chain attacks (linked to TeamPCP). Trivy supply chain attack enabled European Commission cloud breach CERT-EU confirmed that ShinyHunters are behind the recent breach of the cloud infrastructure underpinning websites of the European Commission, and that they stole and subsequently leaked approximately 340 GB of data. FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616) Attackers have been observed exploiting two vulnerabilities (one a zero-day) in Fortinet FortiClient Endpoint Management Server (EMS) this week: a previously fixed SQL injection vulnerability (CVE-2026-21643) and a newly unearthed API authentication and authorization bypass exploited as a zero-day (CVE-2026-35616). Cisco IMC auth bypass vulnerability allows attackers to alter user passwords (CVE-2026-20093) Cisco has fixed ten vulnerabilities affecting its Integrated Management Controller (IMC), the most critical of which (CVE-2026-20093) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. EvilTokens ramps up device code phishing targeting Microsoft 365 users Security researchers report a notable increase in device code phishing activity aimed at Microsoft 365 users, and have attributed this rise to the availability of EvilTokens, a new, specialized phishing toolkit that’s being offered as-a-service via Telegram. Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281) Google has fixed 21 vulnerabilities affecting its popular Chrome browser, among them a zero-day (CVE-2026-5281) with an in-the-wild exploit. As per usual, information about the fixed zero-day is limited, and there’s no details about the exploit (or how/if it’s being used by attackers). Claude Code source leak exploited to spread malware A source code leak involving Anthropic’s Claude Code tool quickly escalated into a cybersecurity threat, as attackers seized on the exposed files to lure developers into downloading malware disguised as “unlocked” versions of the software. Why risk alone doesn’t get you to yes The hardest mission that most security leaders will face is not identifying a threat, but getting someone to act on it. We’re trained to see exposure before they are identified by others. We continually assess likely threats, evaluate impact, and design controls to prevent disruption long before it reaches operations or shareholders. That’s the job. Why I’m done calling humans the weakest link Cybersecurity has long suffered from a people problem, but not in the way we often hear about. As industry that is based on enabling communication across the globe via the internet and many types of devices, many of us practitioners are very bad at communicating to people. The art of making technical risk make sense to executives In this Help Net Security video, Jay Miller, CISO at Paessler, explains how security leaders can communicate technical risk to executives and board members in terms they understand. Your customer passed authentication. So why are they sending money to a scammer? In this Help Net Security video, Lenny Gusel, Head of Fraud Solutions in North America at Feedzai, explains how customer identity and access management has converged with digital fraud detection, and why treating them as separate systems creates real risk. Don’t count on government guidance after a smart home breach People are filling their homes with internet-connected cameras, speakers, locks, and routers. When one of those devices is compromised, the next steps are often unclear. Researchers reviewing government cybersecurity advice in 11 countries found that most guidance focuses on prevention, leaving households with limited support after a breach. Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step The open-source spam filtering platform Rspamd released version 4.0.0, delivering infrastructure changes across its scan protocol, memory model, hash storage, and configuration system. Several of the changes are breaking, and at least one requires a migration step before upgrade. Apple counters ClickFix attacks with macOS Terminal warning Apple has added a new security feature in macOS Tahoe 26.4 that warns users before they enter commands in Terminal that could cause harm. The goal is to stop ClickFix attacks, a social engineering trick that gets users to run malicious commands themselves. Hacker stripped more than $50 million from Uranium crypto exchange, spent it on trading cards US prosecutors have charged a Maryland man in connection with two hacks of the Uranium Finance cryptocurrency exchange that led to losses exceeding $50 million. Amazon sends AI agents into pen testing and DevOps Amazon’s latest AI capabilities bring on-demand penetration testing through the AWS Security Agent, alongside the AWS DevOps Agent. AWS Security Agent enables on-demand penetration testing for applications, addressing gaps created by periodic testing limited by time and cost. Crypto industry may be running out of time to prepare for quantum attacks Google’s latest research suggests the cryptocurrency industry may have less time than expected to prepare for quantum computing. Cybercriminals take aim at Hasbro, weeks of recovery ahead Hasbro, an American toy maker with more than 5,000 employees, confirmed a cyberattack and proactively took certain systems offline. The intrusion was detected on March 28, and the company promptly activated its incident response protocols. TrueConf zero-day vulnerability exploited to target government networks Suspected China-nexus attackers have leveraged a zero-day vulnerability (CVE-2026-3502) in the TrueConf client application to distribute malware within government networks in Southeast Asia, Check Point researchers discovered. DarkSword exploit forces Apple to loosen its patching policy Apple has extended security updates to a wider range of devices still running iOS 18, aiming to protect users from the DarkSword exploit kit. Microsoft releases open-source toolkit to govern autonomous AI agents AI agents can book travel, execute financial transactions, write and run code, and manage infrastructure without human intervention at each step. Frameworks like LangChain, AutoGen, CrewAI, and Azure AI Foundry Agent Service have made this kind of autonomy straightforward to deploy. The governance infrastructure to match that autonomy has lagged behind. Microsoft released the Agent Governance Toolkit to address that gap. Breaking out: Can AI agents escape their sandboxes? Container sandboxes are part of routine AI agent testing and deployment. Agents use them to run code, edit files, and interact with system resources without direct access to the host. The SandboxEscapeBench benchmark, developed by researchers at the University of Oxford and the AI Security Institute, evaluates whether an agent with shell access can escape a container and reach the host system. ShipSec Studio brings open-source workflow orchestration to security operations Security teams have long relied on a mix of shell scripts, cron jobs, and loosely connected tools to chain reconnaissance and vulnerability scanning work together. ShipSec Studio, an open-source security workflow automation platform from ShipSec AI, aims to replace that arrangement with a dedicated orchestration layer built specifically for security operations. SystemRescue 13 updates its kernel to Linux 6.18 LTS, adds new recovery tools Bootable Linux recovery environments occupy a specific niche in the systems administration and incident response toolkit. SystemRescue, an Arch-based live distribution built for repairing unbootable systems and recovering data from damaged drives, has shipped version 13.00 with a new long-term supported kernel, updated storage tools, and several additions to its command-line toolset. Android 17 tweaks location privacy with one-time access Google introduced a suite of location privacy features in Android 17 Beta 3 to give users more control and provide developers with tools for data minimization and product safety. Hottest cybersecurity open-source tools of the month: March 2026 Presented here is a curated selection of noteworthy open-source cybersecurity solutions that have drawn recognition for their ability to enhance security postures across diverse settings. Intel puts its data center performance knowledge on GitHub Intel engineers have published a centralized repository of data center performance knowledge on GitHub, giving practitioners direct access to tuning guides, configuration recommendations, and optimization recipes that previously required hunting across forums and scattered documentation. Android developers just got a new verification layer To help prevent malicious actors from spreading harmful apps while hiding behind anonymity, Google is rolling out developer verification to all Android developers. The company is also introducing app registration, which links apps to verified developer identities. Google Drive now detects ransomware and helps restore affected files To help organizations minimize the impact of malware attacks on personal computers, Google launched ransomware detection and file restoration in beta in September 2025. These features are now generally available. Windows 11 gets a rebuilt console engine with regex search, Sixel images and a 10x speed boost Microsoft released Windows 11 Insider Preview Build 29558.1000 to the Canary Channel, part of the optional 29500 build series. The build carries a set of changes focused on the Windows Console, a handful of bug fixes, and small improvements to Settings and disk utilities. Malware detectors trained on one dataset often stumble on another Machine learning models built to catch malware on Windows systems are typically evaluated on data that closely resembles their training set. In practice, the malware arriving on enterprise endpoints looks different, comes from different sources, and in many cases has been deliberately obfuscated to evade detection. A study from researchers at the Polytechnic of Porto tests what happens when that gap is made explicit, and the results have direct implications for organizations relying on static detectors as a first line of defense. Microsoft adds high-volume email sending to Exchange Online Organizations that rely on Exchange Online for internal communications have long needed a way to send large volumes of automated messages, such as payroll notifications, IT alerts, and security advisories, without running into the sending limits designed for person-to-person email. Microsoft has addressed that with the general availability of High Volume Email (HVE) in Exchange Online. Tracking drones with the 5G tower down the street Drone detection in cities is expensive. Dedicated radar installations are cost-prohibitive at scale, cameras have limited range and stop working well at night, and LiDAR systems have the same cost problem as radar. A group of researchers at the University of Science and Technology of China spent the past year working on a different approach: using 5G-Advanced base stations that are already in the ground to do the job instead. Which messaging app takes the most limited approach to permissions on Android? Messaging apps handle sensitive conversations, contacts, and media, and their behavior on a device varies in ways that affect privacy. An analysis of Android versions of Messenger, Signal, and Telegram shows that differences in permissions, background activity, and system exposure shape how much data each app can access and how often it communicates. Download: 2026 SANS Identity Threats & Defenses Survey New research from the 2026 SANS Identity Threats & Defenses Survey shows that 55% of organizations experienced an identity-related compromise last year, while 26% reported MFA fatigue as a factor in identity attacks. Cybersecurity jobs available right now: March 31, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the month: March 2026 Here’s a look at the most interesting products from the past month, featuring releases from Beazley, Bonfy.AI, Mend.io, Mimecast, NinjaOne, Novee, Intel 471, Singulr AI, Stellar Cyber, Teleport, and Vicarius.

The maintainers of the popular Axios HTTP client have published a detailed post-mortem describing how one of its developers was targeted by a social engineering campaign linked to North Korean hackers. This follows the threat actors compromising a maintainer account to publish two malicious versions of Axios (1.14.1 and 0.30.4) to the npm package registry, triggering a supply chain attack. These releases injected a dependency named plain-crypto-js that installed a remote access trojan (RAT) on macOS, Windows, and Linux systems. The malicious versions were available for roughly three hours before being removed, but systems that installed them during that period should be considered compromised, and all credentials and authentication keys should be rotated. The Axios maintainers said they have wiped affected systems, reset all credentials, and are implementing changes to prevent similar incidents. The Google Threat Intelligence Group has since linked this attack to North Korean threat actors tracked as UNC1069. "GTIG attributes this activity to UNC1069, a financially motivated North Korea-nexus threat actor active since at least 2018, based on the use of WAVESHAPER.V2, an updated version of WAVESHAPER previously used by this threat actor," explains Google. "Further, analysis of infrastructure artifacts used in this attack shows overlaps with infrastructure used by UNC1069 in past activities." Targeted in a social engineering attack According to a post-mortem, the compromise began weeks earlier through a targeted social engineering attack on the project's lead maintainer, Jason Saayman. The attackers impersonated a legitimate company, cloned its branding and founders' likenesses, and invited the maintainer into a Slack workspace designed to impersonate the company. Saayman says the Slack server contained realistic channels, with staged activity and fake profiles that posed as employees and other open-source maintainers. "They then invited me to a real slack workspace. this workspace was branded to the companies ci and named in a plausible manner," explained Saayman in a post to the post-mortem. "The slack was thought out very well, they had channels where they were sharing linked-in posts, the linked in posts i presume just went to the real companys account but it was super convincing etc. they even had what i presume were fake profiles of the team of the company but also number of other oss maintainers." The attackers then scheduled a meeting on Microsoft Teams that appeared to include numerous people. During the call, a technical error was displayed, claiming that something on the system was out of date, prompting the maintainer to install a Teams update to fix the error. However, this fake update was actually RAT malware that gave threat actors remote access to the maintainer's device, allowing them to obtain the npm credentials for the Axios project. Other maintainers reported similar social engineering attacks, where the threat actors tried to get them to install a fake Microsoft Teams SDK update. This attack is similar to a ClickFix attack, in which victims are shown a fake error message and then prompted to follow troubleshooting steps that deploy malware. This attack also mirrors previous campaigns reported by Google's threat intelligence teams, in which North Korean threat actors tracked UNC1069 used the same tactics to target cryptocurrency firms. In previous campaigns attributed to the UNC1069 threat actor, the threat actors would deploy additional payloads on devices, such as backdoors, downloaders, and infostealers designed to steal credentials, browser data, session tokens, and other sensitive information. Since the attackers gained access to authenticated sessions, MFA protections were effectively bypassed, allowing access to accounts without having to re-authenticate. The Axios maintainers confirmed that the attack did not involve modifying the project's source code, but instead relied on injecting a malicious dependency into otherwise legitimate releases. Pelle Wessman, a maintainer of numerous open-source projects, including the popular Mocha framework, posted on LinkedIn that he was targeted in the same campaign and shared a screenshot of a fake RTC connection error message used to trick targets into installing malware. When Wessman refused to install the app, the threat actors tried to convince him to run a Curl command. "When it became clear that I wouldn’t run the app and we had chatted back and forth on website and chat app they made one final desperate attempt and tried to get me to run a curl command that would download and run something, then when I refused they went dark and deleted all conversations," explained Wessman. Cybersecurity firm Socket also reported that this was a coordinated campaign that has begun targeting maintainers of popular Node.js projects. Multiple developers, including maintainers of widely used packages and Node.js core contributors, reported receiving similar outreach messages and invitations to Slack workspaces operated by the attackers. Socket noted that these maintainers are responsible for packages with billions of weekly downloads, demonstrating that the threat actors focused on high-impact projects. "Since we published our initial analysis of the axios compromise, a deep dive into its hidden blast radius, and a report on the maintainer confirming it was social engineering, maintainers across the Node.js ecosystem have come out of the woodwork to report that they were targeted by the same social engineering campaign," explained Socket. "The accounts now span some of the most widely depended-upon packages in the npm registry and Node.js core itself, and together they confirm that axios was not a one-off target. It was part of a coordinated, scalable attack pattern aimed at high-trust, high-impact open source maintainers." Socket said the campaign followed a consistent pattern, with the threat actors first making contact through platforms like LinkedIn or Slack and then inviting recipients into private or semi-private workspaces. After building rapport with the target, the threat actors scheduled video calls, which in some cases were conducted through sites impersonating Microsoft Teams and other platforms. During these calls, an error message would be displayed to the targets, which prompted them to install "native" desktop software that works better or run commands to fix the technical issues. The same playbook used against all these targets during the same time period indicates this was a coordinated campaign rather than a series of one-off attacks. The Socket researchers say that these types of supply chain attacks are becoming more common, with attackers now focusing on widely used packages to cause widespread impact. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

This is the sixth update to the TeamPCP supply chain campaign threat intelligence report, "When the Security Scanner Became the Weapon" (v3.0, March 25, 2026). Update 005 covered developments through April 1, including the first confirmed victim disclosure (Mercor AI), Wiz's post-compromise cloud enumeration findings, DPRK attribution of the axios compromise, and LiteLLM's release resumption after Mandiant's forensic audit. This update covers intelligence from April 1 through April 3, 2026. CRITICAL: CERT-EU Confirms European Commission Cloud Breach via Trivy Supply Chain Compromise CERT-EU disclosed on April 2-3, 2026 that the European Commission's Europa web hosting platform on AWS was breached through the Trivy supply chain compromise (CVE-2026-33634). This is the highest-profile governmental victim disclosure to date. Key details from the CERT-EU advisory: Initial access: AWS API keys stolen via the compromised Trivy scanner on March 19 Detection: European Commission Security Operations Center fired alerts on March 24 (5 days after initial intrusion) CERT-EU notified: March 25; access revoked same day Data exfiltrated: 340 GB uncompressed (91.7 GB compressed archive) from the compromised AWS account Email exposure: Approximately 52,000 email-related files (2.22 GB) of outbound communications Scope: 71 clients affected: 42 internal European Commission departments plus 29 other EU entities, meaning at least 30 Union entities were potentially impacted Data publication: ShinyHunters published the stolen data on their dark web leak site on March 28 Lateral movement: CERT-EU confirmed no lateral movement to other Commission AWS accounts was detected Europa.eu websites remained unaffected throughout Analysts assess this disclosure is significant on multiple dimensions. First, it confirms that TeamPCP-harvested credentials reached a major governmental institution, not just private-sector targets. Second, the involvement of ShinyHunters in the data publication raises questions about the credential distribution chain, as ShinyHunters is operationally distinct from TeamPCP's known LAPSUS$ and Vect partnerships. Third, the five-day dwell time between initial access (March 19) and detection (March 24) is consistent with the 24-hour operational tempo that Wiz documented for TeamPCP's post-compromise cloud enumeration. Recommended action: EU institutions and organizations hosted on Europa infrastructure should review CERT-EU's advisory for specific exposure indicators. Organizations with AWS credentials that may have been exposed through the Trivy compromise should treat the EC breach as confirmation that stolen credentials are being actively used against high-value targets. The CERT-EU disclosure timeline (initial access March 19, detection March 24, notification March 25, public disclosure April 2) demonstrates that even well-resourced organizations required five days to detect the intrusion. HIGH: Sportradar AG Breach Details Confirmed: TeamPCP and Vect Joint Operation VECERT reported on April 2, 2026 that the Sportradar AG breach (first claimed as a CipherForce victim in Update 004) has been confirmed as a "systemic compromise" jointly operated by TeamPCP and Vect ransomware. Sportradar is a $4.98 billion Swiss sports technology company. Confirmed breach details: Entry vector: Supply chain via compromised Trivy (CVE-2026-33634) Personal data: Approximately 26,000 users' personal information exposed Athlete records: 23,169 records including names, dates of birth, gender, and nationality Client exposure: Client table listing 161 organizations including ESPN, Nike, NBA Asia, and IMG Arena Credential exposure: 8 production RDS database passwords, 328 platform API key/secret pairs, Kafka SASL credentials, and New Relic monitoring tokens CipherForce ransomware: Listed on the CipherForce shame site with the original 14-15 day publication deadline (approaching approximately April 10-11) This is the first confirmed case of TeamPCP and Vect operating jointly against a single target, validating the dual-track ransomware model documented in earlier updates. The exposure of 161 client organizations including major sports leagues and media companies creates a cascading notification and risk assessment obligation for Sportradar. Recommended action: Organizations with Sportradar business relationships should proactively assess whether their data appears in the exposed client table. The 328 exposed API key/secret pairs create a secondary supply chain risk for Sportradar's integration partners. HIGH: Mandiant Quantifies Campaign Scale: Over 1,000 SaaS Environments, Estimated 500,000 Machines Multiple vendor statements published April 1-2 have provided the first authoritative quantification of the campaign's total blast radius: Mandiant CTO Charles Carmakal stated that Google-owned Mandiant knew of "over 1,000 impacted SaaS environments" actively dealing with cascading effects from the TeamPCP supply chain compromises. Google Cloud researchers warned that "hundreds of thousands of stolen secrets could potentially be circulating" from the credential trove. The Register cited estimates suggesting attackers exfiltrated data and secrets from approximately 500,000 machines total across all victims. Palo Alto Networks Unit 42 identified affected organizations across the US, Europe, Middle East, South Asia, and Australia, spanning financial services, technology, retail, legal, insurance, and education sectors. These numbers move the campaign's assessed scale from qualitative ("thousands of downstream environments," per the FBI alert) to quantitative. The 1,000+ SaaS environments figure is particularly significant because it implies credential exploitation is ongoing across a far larger surface than the handful of publicly named victims suggests. Recommended action: Organizations that have not yet completed credential rotation should treat the Mandiant quantification as definitive evidence that delayed rotation increases exposure to an actively exploited credential pool of industrial scale. MEDIUM: Elastic Security Labs Publishes Container Attack Detection Guide with MITRE ATT&CK Mapping Elastic Security Labs published a new technical resource, "Linux & Cloud Detection Engineering: TeamPCP Container Attack Scenario," providing a full walkthrough of TeamPCP's multi-stage container compromise methodology. This is distinct from Elastic's earlier axios supply chain compromise detections covered in Update 005 and focuses specifically on the TeamPCP toolchain. New technical details documented: Tunneling tools: TeamPCP uses frps (fast reverse proxy) and gost for establishing persistent tunnels and proxying through compromised container environments React2Shell: A web server exploitation technique used for initial foothold in containerized workloads D4C telemetry: Full detection walkthrough using Elastic's Defend for Containers telemetry MITRE ATT&CK mapping: Each stage of the container attack chain mapped to specific ATT&CK techniques, providing structured detection logic Recommended action: SOC teams operating containerized workloads should review the Elastic guide for detection rules specific to TeamPCP's container attack methodology. The frps and gost indicators are new IOCs not previously documented in the campaign's public reporting. MEDIUM: Mercor Breach Triggers Class Action Investigations The Mercor AI breach (first confirmed in Update 005) has escalated beyond incident response into legal proceedings. Shamis & Gentile P.A. has launched a class action investigation into Mercor's data breach, focusing on the exposure of contractor and customer data including biometric identity verification materials (passports and video interviews). Additional context that emerged April 1-2: Fortune reported Mercor is valued at $10 billion (raised $350M Series C in October 2025) Mercor's customers confirmed to include Anthropic, OpenAI, and Meta LAPSUS$ published samples including Slack data, internal ticketing records, and two videos of AI-contractor conversations Data is listed for live auction on the dark web The class action investigation introduces a legal dimension to the campaign's downstream consequences. The exposure of biometric identity verification materials (passports) for an estimated 30,000+ AI contractors raises GDPR, CCPA, and potentially BIPA obligations. INFO: New Vendor Publications and Analysis Several new vendor publications appeared in the April 1-3 window: Datadog Security Labs published a detailed technical trace of the full LiteLLM and Telnyx PyPI compromise chain, tracing it back to the March 19 Trivy origin and recommending that any host that installed compromised versions be treated as a "full-credential exposure event." Oligo Security published "Evolution of Modern Supply Chain Attacks," documenting TeamPCP's credential harvesting timeline and framing the campaign as a "meaningful shift" in how sophisticated actors approach supply chain as an attack surface. The New Stack (April 2) published "The CI/CD Pipeline Is the New Front Line," positioning TeamPCP as a watershed moment for CI/CD pipeline security. CYFIRMA Weekly Intelligence Report (April 3) covered the campaign, noting the Europa hosting platform impact and the 71 affected clients. INFO: Supply Chain Pause Extends to Approximately 16 Days No new package compromises have been reported since the Telnyx PyPI disclosure on March 27. The supply chain pause is now approximately 384 hours (16 days), doubling the 192-hour pause reported in Update 005. Independent searches of RubyGems, crates.io, and Maven Central continue to show zero TeamPCP-related IOCs. The campaign remains confined to five ecosystems: GitHub Actions, PyPI, npm, Docker Hub/GHCR, and OpenVSX. The CISA KEV remediation deadline for CVE-2026-33634 is now 5 days away (April 8, 2026). Watch Item Status

Software supply chain hacks trigger wave of intrusions, data theft After linking the Axios npm supply chain attack to North Korean hackers, Google researchers warned that “hundreds of thousands of stolen secrets could potentially be circulating” as a result of this and the Trivy, KICS, LiteLLM, and Telnyx supply chain attacks (linked to TeamPCP). “This could enable further software supply chain attacks, software as a service (SaaS) environment compromises (leading to downstream customer compromises), ransomware and extortion events, and cryptocurrency theft over the near term,” they added. TeamPCP exploits stolen secrets for cloud intrusions Google-owned cloud security company Wiz has responded to multiple attacks being carried out by TeamPCP. “[The Wiz Customer Incident Response Team (CIRT)] saw indications in Cloud, Code, and Runtime evidence that the credentials and secrets stolen in the supply chain compromises were quickly validated and used to explore victim [cloud] environments and exfiltrate additional data,” they said. “While the speed at which they were used suggests that it was the work of the same threat actors responsible for the supply chain operations, we are not able to rule out the secrets being shared with other groups and used by them.” Tech firm OwnCloud stated last week that it had been affected by the Trivy compromise and their ability to ship new builds of and patches for their software solutions “is temporarily suspended.” Mercor, a startup that connects human experts with companies building AI, confirmed on Wednesday that it was affected by the LiteLLM supply chain attack. The company said it is “one of thousands of companies” impacted and its security team and third-party forensics experts are still investigating the incident. Though the Lapsus$ cyber extortion group claimed to have accessed the company’s databases and source code, Mercor has yet to disclose the extent of the impact/breach. The connection between TeamPCP and Lapsus$ has been documented. Evidence from Lapsus$’s Telegram channel indicates they had prior knowledge of TeamPCP’s planned supply chain attacks. TeamPCP has also apparently partnered with the Vect ransomware-as-a-service operation, and is professedly working on spinning up its own RaaS program called CipherForce. Axios compromise affected organizations around the world Axios is one of the most widely used JavaScript libraries out there, and the Axios npm supply chain compromise is expected to have a widespread impact. “With over 100 million weekly downloads across both [affected] branches [of Axios npm], the blast radius of a three-hour compromise window is significant,” Tenable researchers noted. Palo Alto Networks reports that this supply chain compromise has affected organizations across the US, Europe, Middle East, South Asia and Australia, operating in a variety of industries: financial services, high-tech, retail, professional and legal services, insurance, higher education, customers service, and more. The attack resulted in a remote access trojan being installed on Windows, macOS and Linux systems, allowing operators to perform system reconnaissance and drop and execute additional binary payloads and commands. The North Korean group (UNC1069) behind the Axios breach is known for using social engineering to trick people – especially in crypto, DeFi, software, and VC firms – into installing malware, which matches how the Axios maintainer said his system was compromised. Historically, they have been financially motivated. “While UNC1069 has had a smaller impact on cryptocurrency heists compared to other groups like UNC4899 in 2025, it remains an active threat targeting centralized exchanges and both entities and individuals for financial gain,” Mandiant researchers noted earlier this year. UPDATE (April 3, 2026, 09:05 a.m. ET): CERT-EU says that the initial access vector in the recent European Commission cloud breach was the Trivy supply-chain compromise. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Unit 42 stopped monitoring this threat and updating the brief on May 19, 2026. Please refer to the npm website for the latest information. Unit 42 researchers have observed widespread impact from the significant supply chain attack targeting the Axios JavaScript library. The attack occurred after an Axios maintainer's npm account was hijacked, leading to the release of malicious updates (versions v1.14.1 and v0.30.4). These compromised versions introduced a hidden dependency called plain-crypto-js. This dependency is a cross-platform remote access Trojan (RAT) capable of affecting Windows, macOS and Linux systems. The malware was designed to perform reconnaissance and establish persistence, with an added feature to self-destruct for evasion. Axios is a popular, promise-based HTTP client library for JavaScript, used to make API requests in browsers and Node.js. It features automatic JSON data transformation, request/response interception and request cancellation, making it a standard tool for connecting frontend apps to backend services. Analysis of malware that the attackers used overlaps with operations previously reported to involve the Democratic People’s Republic of Korea (DPRK). This campaign has affected the following sectors in the U.S., Europe, Middle East, South Asia and Australia: Business services Customer Service Financial services High tech Higher education Insurance Media and entertainment Medical equipment Professional and legal services Retail services This article recommends a number of mitigations for the attack. Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services: Advanced URL Filtering and Advanced DNS Security Advanced Threat Prevention Advanced WildFire Cortex AgentiX Cortex Cloud Cortex XDR and XSIAM The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk. The attacker published two compromised versions of Axios (v1.14.1 and v0.30.4) but they did not modify any of the Axios source code. Instead, they injected [email protected] into the package.json file as a runtime dependency. With compromised versions of Axios, when a developer runs npm install axios, npm automatically resolves the dependency tree and installs plain-crypto-js. This triggers npm's postinstall lifecycle hook, executing a heavily obfuscated Node.js dropper script named setup.js in the background. To obfuscate its operations, setup.js uses a two-layer encoding scheme involving string reversal, Base64-decoding and an XOR cipher using the key OrDeR_7077. The dropper queries the operating system and sends an HTTP POST request to a command-and-control (C2) server at sfrclak[.]com:8000. To make this outbound traffic look like benign npm registry requests, it appends platform-specific paths: packages.npm[.]org/product0 for macOS packages.npm[.]org/product1 for Windows packages.npm[.]org/product2 for Linux Figure 1 shows the commands for this first-stage download. The C2 server delivers a different payload depending on the victim's operating system: macOS: The dropper uses AppleScript to download a C++ compiled Mach-O binary, saves it to /Library/Caches/com.apple.act.mond, makes it executable and launches it silently via /bin/zsh. Windows: The dropper searches for and copies the legitimate Windows PowerShell binary to %PROGRAMDATA%\wt.exe. It then uses VBScript to fetch and execute a secondary PowerShell RAT script, which is subsequently executed by wt.exe. It also establishes persistence via a registry Run key. Linux: The dropper uses the Node.js execSync command to download a Python RAT script to /tmp/ld.py, running it in the background using the nohup command. Despite being written in three different languages (C++, PowerShell and Python), all three payloads function as implementations of the same RAT framework. They all use an identical C2 protocol, send Base64-encoded JSON data over an HTTP POST request and beacon to the server every 60 seconds. The C2 server accepts the same four commands from the attacker: kill (self-terminate) runscript (execute shell/script commands) peinject (drop and execute binary payloads) rundir (enumerate directories) All the RAT variants use a hard-coded, highly anachronistic user-agent string spoofing Internet Explorer 8 on Windows XP: mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0. Initial analysis of the payload confirms significant overlap with WAVESHAPER. WAVESHAPER is a C++ backdoor that communicates with its C2 server using the curl library, employing either HTTP or HTTPS as specified in the command-line arguments. The C2 server's address is also provided via command-line parameters, allowing the backdoor to download and execute arbitrary payloads from the adversary's infrastructure. WAVESHAPER also runs as a daemon by forking itself into a child process that runs in the background, detached from the parent session. It collects the returned system information, which is sent to the C2 server in an HTTP POST request. The entire process from installation to compromise takes roughly 15 seconds. Upon successfully launching the payload, the Node.js dropper performs aggressive anti-forensic cleanup. It deletes the setup.js file, removes the postinstall hook and replaces the tampered package.json with a clean decoy file named package.md. This ensures that developers inspecting their node_modules folders after the installation will find no obvious signs of malicious code. The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit this situation across our customers, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to search for signs of exploitation. Attackers have been increasing the frequency and scale of npm supply chain operations since early 2026. Securing the continuous integration/continuous deployment (CI/CD) pipeline should be a high priority for any organization to mitigate against this growing threat. Based on the amount of publicly available information, we highly recommend the following actions: Audit for malicious packages: Search your projects and node_modules directories for the compromised Axios versions (1.14.1 and 0.30.4) and the injected plain-crypto-js package (versions 4.2.0 and 4.2.1). Check for malware artifacts: Inspect systems for platform-specific indicators of compromise, such as /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\wt.exe (Windows) and /tmp/ld.py (Linux). Isolate affected systems: If you discover the malicious packages or RAT artifacts, immediately isolate the system from the network. Rebuild from scratch: If an environment is compromised, do not attempt to clean the malware while it is still in place. Instead, completely rebuild the environment from a known-good state. Clear caches: Clear your local and shared package manager caches (npm, yarn, pnpm) on all workstations and build servers to prevent reinfection during future installs. Assume compromise: If the malicious package was executed, you must assume all secrets accessible on that machine have been stolen. Rotate all secrets: Immediately rotate exposed credentials, including npm tokens, AWS access keys, SSH private keys, cloud environment credentials (Google Cloud, Azure), CI/CD secrets and any sensitive values stored in .env files. Downgrade Axios: Immediately downgrade to the last known safe versions of Axios: 1.14.0 or 0.30.3. Pin dependencies: Pin Axios to these safe versions within your package-lock.json file to prevent accidental upgrades. Use overrides: Add an overrides block in your package configuration to prevent malicious versions from being resolved transitively by other packages. Restrict corporate repositories: Configure corporate-managed npm repositories to strictly serve only the known-good versions of Axios. Block C2 traffic: Block all egress traffic to the attacker's C2 domain (sfrclak[.]com) and IP address (142.11.206[.]73). Monitor logs: Monitor network logs for suspicious outbound connections over port 8000, beaconing behavior and anomalous HTTP POST requests. Audit CI/CD pipelines: Review automated build logs to see if the affected versions were installed during recent runs. Rotate any secrets for workflows that executed them. Pause and validate deployments: Temporarily pause CI/CD deployments for projects relying on Axios, to validate that your builds are not automatically pulling the poisoned “latest” versions. Disable lifecycle scripts: Use the --ignore-scripts flag during CI/CD installations to explicitly prevent npm postinstall hooks from running during automated builds. Sandbox environments: Isolate development environments using containers or sandboxes to restrict host file system access. Vault secrets: Migrate plaintext secrets away from developer machines and into secure vaults or OS keychains (using tools like aws-vault) so that malicious scripts cannot programmatically scrape them. Deploy endpoint detection and response (EDR): Ensure EDR solutions are deployed on developer workstations to monitor for suspicious processes spawning from Node.js applications. Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. Palo Alto Networks customers are better protected by our products, as listed below. We will update this threat brief as more relevant information becomes available. Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat. If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Advanced WildFire The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of indicators shared in this research. Next-Generation Firewalls With Advanced Threat Prevention Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attack via the following Threat Prevention signature: 87121. Advanced URL Filtering and Advanced DNS Security identify known IP addresses and domains associated with this activity as malicious. Cortex AgentiX Security analysts can use natural language to prompt the Cortex AgentiX Threat Intel agent to extract file indicators of compromise (IoCs) from this threat brief. They will then need to enrich them, check for sightings in their Cortex tenant and related alerts, and provide a quick summary of the impact to the organization. Cortex XDR and XSIAM provide a multi-layer defense to help protect against the initial access, C2 and potential lateral movement described in this article. This includes Behavioral Threat Protection (BTP), Advanced WildFire and Cortex Analytics. Specifically, we have observed out-of-the-box (OotB) prevention via Advanced WildFire and BTP for the second stages of this attack on Windows and macOS. Cortex Analytics can help detect C2 activity and suspicious supply chain activity using our tailored detectors described in the following articles: How Behavioral Analytics Stop Linux C2 & Credential Theft - Palo Alto Networks Blog How Cortex XDR Global Analytics Protects Against Supply Chain Attacks - Palo Alto Networks Blog We advise customers to upgrade agents to supported versions and the latest content update to receive the best protection. The Cortex Cloud platform provides detection and prevention operations for both the first and second stages of the Axios attack chain. This includes Software Supply Chain Security, Application Security (AppSec), Cloud Workload Protection (CWP), Cortex XDR and XSIAM. Every phase of the attack can be mapped to a Cortex Cloud capability that either helps prevent or detects it, from CI/CD trusted publisher verification operations to runtime post-installation monitoring and endpoint persistence detection. ad8ba560ae5c4af4758bc68cc6dcf43bae0e0bbf9da680a8dc60a9ef78e22ff7 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf cdc05cd30eb53315dadb081a7b942bb876f0d252d20e8ed4d2f36be79ee691fa 8449341ddc3f7fcc2547639e21e704400ca6a8a6841ae74e57c04445b1276a10 01c9484abc948daa525516464785009d1e7a63ffd6012b9e85b56477acc3e624 7b47ed28e84437aee64ffe9770d315c1b984135105f7f608a8b9579517bc0695 526ab39d1f56732e4e926715aaa797feb13b1ae86882ec570a4d292e7fdc3699 a98e04dec3a7fe507eb30c72da808bad60bc14d9d80f9770ec99c438faa85a1a 0d83030ab8bfba675fc1661f0756b6770be7dd80b1b718de3d68a01f2e79a5f4 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4 4465bdeaddc8c049a67a3d5ec105b2f07dae72fa080166e51b8f487516eb8d07 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f a224dd73b7ed33e0bf6a2ea340c8f8859dfa9ec5736afa8baea6225bf066b248 5e2ab672c3f98f21925bd26d9a9bba036b67d84fde0dfdbe2cf9b85b170cab71 20df0909a3a0ef26d74ae139763a380e49f77207aa1108d4640d8b6f14cab8ca 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4 4465bdeaddc8c049a67a3d5ec105b2f07dae72fa080166e51b8f487516eb8d07 9c64f1c7eba080b4e5ff17369ddcd00b9fe2d47dacdc61444b4cbfebb23a166c 142.11.206[.]73 sfrclak[.]com callnrwise[.]com hxxp://sfrclak[.]com:8000 hxxp://sfrclak[.]com:8000/6202033 Updated April 1, 2026, at 1:15 p.m. PT to add coverage for Advanced WildFire. Updated April 9, 2026, at 8:50 a.m. PT to add coverage for Advanced Threat Prevention. Updated April 13, 2026, at 12:50 p.m. PT to clarify how the RAT is executed in its Windows version. Added coverage for Cortex AgentiX.

North Korean hackers linked to Axios npm supply chain compromise The software supply chain attack that resulted in the compromise of npm packages of Axios, an extremely popular HTTP client library, is believed to be the work of financially-motivated North Korean attackers. Links to UNC1069 On March 31, 2026, unknown attackers managed to publish two backdoored Axios npm packages after gaining access to a maintainer’s npm account. The malicious versions introduced a hidden dependency containing a post-install script, and this script executed automatically during installation and attempted to download and run additional payloads from the attacker-controlled infrastructure. The goal was to deploy malware capable of remote access and system compromise, potentially allowing attackers to steal sensitive data or move laterally within affected environments. The stealth and sophistication of the attack pointed to skilled attackers. The injected code was minimal and designed to evade detection and the malicious behavior was offloaded to the external dependency and remote payload, which made it harder for developers or automated tools to quickly identify the compromise. The attribution of the attack was made by Google Threat Intelligence Group (GTIG) researchers and Mandiant analysts, based on the backdoor that was deployed on victim systems and the command and control (C2) infrastructure used. “The platform-specific payloads ultimately deploy variants of a backdoor tracked by GTIG as WAVESHAPER.V2, a backdoor written in C++ that targets macOS to collect system information, enumerate directories, or execute additional payloads and that connects to the C2 provided via command-line arguments,” the researchers noted. Additional variants of WAVESHAPER.V2 have been written in PowerShell and Python to target Windows and Linux environments, respectively. The backdoor acts as a remote access trojan and is capable of system reconnaissance, file system enumeration, and code execution. Previous versions of the backdoor were used by a North Korea-nexus threat actor GTIG calls UNC1069, which has been active since at least 2018 and is known for targeting organizations to steal cryptocurrency. “Analysis of the C2 infrastructure (sfrclak[.]com resolving to 142.11.206.73) revealed connections from a specific AstrillVPN node previously used by UNC1069. Additionally, adjacent infrastructure hosted on the same ASN has been historically linked to UNC1069 operations,” they added. Further breaches expected The exposure window was short – the malicious Axios npm versions were available less than three hours before being removed – but even such a short-lived compromise is expected to have a wide impact. “This compromise is particularly significant because Axios is a widely used library and is often included as a transitive dependency across millions of applications,” noted Andres Ramos, Senior Threat Intelligence Researcher at Arctic Wolf. “Organisations that install npm packages in CI/CD pipelines may have automatically pulled the malicious versions into build environments during the ~3-hour window Even systems that did not directly install Axios could be indirectly impacted if another package in the environment depended on the compromised versions, highlighting the broader downstream risk across modern JavaScript ecosystems.” Various security companies have offered remediation advice for potentially affected developers and organizations, as well as threat detection rules, and advice aimed at preventing similar attacks affecting them in the future. Similarly, many companies have provided advice for those affected by the other supply chain attacks that happened in the last few days and targeted open-source projects like the Trivy security scanner, the LiteLLM library, and Telnyx on PyPI. Those attacks have all been attributed to the financially-motivated TeamPCP – or, as GTIG calls them, UNC6780 – and there’s reports that the secrets harvested in those attacks will be used by “partnering” groups like the Vect ransomware-as-a-service (RaaS) and extortion groups like Lapsus$. “Hundreds of thousands of stolen secrets could potentially be circulating as a result of these recent attacks. This could enable further software supply chain attacks, software as a service (SaaS) environment compromises (leading to downstream customer compromises), ransomware and extortion events, and cryptocurrency theft over the near term,” GTIG researchers warned. “Defenders should pay close attention to these campaigns, and enterprises should initiate dedicated efforts to assess the existing impact, remediate compromised systems, and harden environments against future attacks.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

This is the fifth update to the TeamPCP supply chain campaign threat intelligence report, "When the Security Scanner Became the Weapon" (v3.0, March 25, 2026). Update 004 covered developments through March 30, including the Databricks investigation, dual ransomware operations, and AstraZeneca data release. This update consolidates two days of intelligence through April 1, 2026. HIGH: Mercor AI Confirms Breach Tied to LiteLLM Supply Chain Compromise - First Official Victim Disclosure AI recruiting startup Mercor has publicly confirmed it was breached as a direct consequence of the LiteLLM supply chain compromise, making it the first organization to officially acknowledge being victimized through the TeamPCP campaign. TechCrunch reported on March 31 that LAPSUS$ claims to have exfiltrated approximately 4TB of data, including 939GB of source code, a 211GB user database, and 3TB of video interviews and identity verification documents (passports). Initial access was reportedly via a compromised Tailscale VPN credential. Mercor stated it was "one of thousands of companies" affected by the LiteLLM compromise. The nature of the claimed exfiltrated data -- which includes biometric identity verification materials -- raises significant privacy and regulatory implications under GDPR, CCPA, and potentially HIPAA depending on the contents. This is operationally significant because it moves the campaign's downstream impact from theoretical to confirmed. Prior victim claims (AstraZeneca, Databricks) remain unconfirmed by the named organizations. Mercor's public acknowledgment validates what analysts have assessed since Update 002: the credential trove harvested during the supply chain phase is being actively exploited for data theft and extortion. Recommended action: Organizations that used LiteLLM v1.82.7 or v1.82.8 should treat this as confirmation that credential exploitation is actively underway. If you have not completed credential rotation, the Mercor disclosure demonstrates the consequence of delay. VPN credentials, cloud access tokens, and API keys accessible in compromised environments should be prioritized for rotation. HIGH: Wiz Documents TeamPCP Post-Compromise AWS and Cloud Enumeration in the Wild SecurityWeek reported on March 31 that Wiz's Cloud Incident Response Team (CIRT) has published detailed findings on TeamPCP's post-compromise cloud operations in "Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild". This is the first detailed public documentation of what TeamPCP does after obtaining stolen credentials. Key findings from the Wiz CIRT investigation: Credential validation via TruffleHog: TeamPCP uses the open-source secret scanning tool TruffleHog to programmatically verify that stolen AWS access keys, Azure application secrets, and SaaS tokens are still valid and in use. 24-hour operational tempo: Within 24 hours of validating stolen secrets, the group transitions to discovery operations in compromised AWS environments. AWS enumeration focus: Discovery operations enumerate IAM roles, EC2 instances, Lambda functions, RDS databases, S3 buckets, and ECS clusters, with particular focus on container infrastructure where the group maps clusters and task definitions. Bold operational signatures: The group uses conspicuous resource names including "pawn" and "massive-exfil" -- analysts assess this indicates either operational carelessness or deliberate intimidation, consistent with their public Telegram messaging. The Wiz findings also contextualize the Flare threat intelligence report, which found that TeamPCP's cloud infrastructure targeting breaks down as Azure (61%) and AWS (36%), accounting for 97% of compromised servers. Recommended action: Organizations should search cloud audit logs for unauthorized IAM enumeration, EC2/ECS/Lambda discovery calls, and S3 listing operations originating from unfamiliar principals. TruffleHog validation attempts may appear as rapid sequential API calls testing credential validity across multiple services. Search for resources with names containing "pawn", "massive-exfil", or similar conspicuous strings. Note for threat hunters: The full Wiz CIRT report contains extensively documented indicators of compromise including specific AWS API call patterns, resource naming conventions, and infrastructure fingerprints observed in the wild. Threat hunters and SOC teams should review the Wiz report in detail for actionable detection content. MEDIUM: Axios npm Compromise Attributed to North Korean UNC1069 - Not TeamPCP, but Credential Source Remains Open The axios npm compromise (March 30-31, malicious versions 1.14.1 and 0.30.4) has received formal attribution. Elastic Security Labs published a detailed analysis identifying the macOS Mach-O binary payload as overlapping with WAVESHAPER, a C++ backdoor that Mandiant attributes to UNC1069, a suspected North Korean threat actor. Google's Threat Intelligence Group published a companion analysis confirming the DPRK attribution. This narrows the assessment from Update 004's "credential provenance raises TeamPCP questions" to a more specific picture: analysts assess with high confidence that a different threat actor executed the axios attack, but the question of how the maintainer's npm token was originally obtained remains unanswered. The token was a long-lived classic npm access token -- exactly the type that TeamPCP's CanisterWorm findNpmTokens() function harvests from CI/CD environments. The timing aligns with TeamPCP's monetization phase and the BreachForums credential distribution to approximately 300,000 users. The SANS ISC Stormcast for April 1, 2026 noted: "Given that TeamPCP recently collected so many developer credentials, it's very possible that they were involved in the Axios compromise, though the follow-up compromise doesn't look like TeamPCP, as the techniques look a little bit different." Singapore's Cyber Security Agency has issued a second advisory, AD-2026-002, specifically addressing the axios supply chain attack -- making Singapore the only government to have issued dedicated advisories for both the TeamPCP campaign and the axios incident. Recommended action: Organizations that installed axios v1.14.1 or v0.30.4 should check for platform-specific IOCs: macOS (/Library/Caches/com.apple.act.mond), Windows (%PROGRAMDATA%\wt.exe), Linux (/tmp/ld.py). Block C2 domain sfrclak[.]com and IP 142.11.206[.]73. The DPRK attribution elevates the severity -- this is now a nation-state operation exploiting the same credential ecosystem that TeamPCP seeded. MEDIUM: LiteLLM Resumes Publishing After Forensic Audit - Release Freeze Lifted BerriAI has lifted the LiteLLM release freeze that has been in effect since March 25. According to the LiteLLM security update, the Mandiant-led forensic audit verified every release from v1.78.0 through v1.82.6 via SHA-256 comparison against the Git repository, confirming no additional compromised versions exist beyond the known-malicious v1.82.7 and v1.82.8. A new safe version was published on March 31, 2026. This resolves the "LiteLLM/BerriAI release resumption" watch item that has been tracked since Update 001. The quarantine lift and publishing resumption signal that the forensic investigation found no evidence of earlier or broader compromise beyond the two known-malicious versions. Recommended action: Organizations that froze LiteLLM upgrades can resume normal update procedures. Verify you are running a version that post-dates the forensic audit. Continue to treat any historical installation of v1.82.7 or v1.82.8 as a confirmed compromise requiring full credential rotation. INFO: ownCloud Discloses CVE-2026-33634 Build Infrastructure Impact ownCloud published a security notice confirming their build infrastructure was affected by the Trivy supply chain compromise (CVE-2026-33634). ownCloud stated that no customer data was compromised, characterizing the impact as limited to build pipeline exposure. This is notable as one of the few organizations to proactively disclose exposure without a corresponding extortion claim. This is a positive example of transparent incident communication. INFO: Supply Chain Pause Extends to Approximately 192 Hours No new package compromises have been reported since the Telnyx PyPI disclosure on March 27. The supply chain pause is now approximately 192 hours (8 days) -- extending the record documented in Updates 003 through the Update 005 draft. The CISA KEV remediation deadline for CVE-2026-33634 is now 7 days away (April 8, 2026). Independent searches of RubyGems, crates.io, and Maven Central continue to show zero TeamPCP-related IOCs. The campaign remains confined to five ecosystems: GitHub Actions, PyPI, npm, Docker Hub/GHCR, and OpenVSX. Watch Item Status The full campaign report is available at sans.org/white-papers/when-security-scanner-became-weapon. A SANS Emergency Webcast replay is available at sans.org/webcasts/when-security-scanner-became-weapon. Updates to the report will be in the form of these ISC diaries.

Un hacker criminale della Corea del Nord avrebbe manomesso il progetto open source Axios, mettendo a rischio la sicurezza degli sviluppatori. Il software open source Axios può servire per diffondere malware, secondo quanto è emerso da un recente caso di studio. Un hacker criminale, presumibilmente legato alla Corea del Nord, lo ha infatti dirottato e modificato, mettendo a rischio la sicurezza di milioni di sviluppatori. La libreria JavaScript Axios compromessa si trovata su npm, un repository di software che archivia il codice dei progetti open source. I download di Axios su base settimanale raggiungono le decine di milioni. In ogni caso, secondo gli analisti cyber che hanno studiato l’attacco, quest’ultimo è stato individuato e bloccato in circa tre ore nella notte tra lunedì e martedì. La dinamica dell’attacco L’hacker criminale è riuscito a introdurre codice dannoso all’interno di Axios compromettendo l’account di uno degli sviluppatori principali del progetto, autorizzato a pubblicare gli aggiornamenti. Avendo sostituito l’indirizzo e-mail dello sviluppatore legittimo con il proprio, ha reso più difficile per lo sviluppatore riottenere l’accesso. Una volta ottenuto il controllo dell’account, il soggetto ha inserito un codice dannoso progettato per distribuire un trojan di accesso remoto, o RAT. Si tratta essenzialmente di un malware in grado di fornire agli hacker il controllo remoto completo del computer della vittima. L’hacker ha quindi distribuito nuove versioni di Axios “sotto forma di un aggiornamento dall’aspetto legittimo per gli utenti di Windows, macOS e Linux“. Secondo gli analisti cyber, gli hacker hanno anche progettato il malware, così come parte del codice utilizzato per distribuirlo. Il tutto, “in modo che si cancellasse automaticamente dopo l’installazione, nel tentativo di nascondersi dai motori anti-malware e dagli investigatori“. Progetti open source a rischio Quello che è accaduto con Axios non è un caso isolato. I cyber criminali prendono infatti sempre più di mira gli sviluppatori di progetti open source popolari nel tentativo di hackerare in massa chiunque si affidi al codice compromesso. In questo modo garantiscono potenzialmente agli hacker l’accesso a un numero enorme di dispositivi colpiti. Questo tipo di violazioni su larga scala sono chiamate attacchi alla catena di approvvigionamento. Il motivo è che prendono di mira software che consentono di colpire chiunque abbia scaricato il componente compromesso. Si pensi solo, negli ultimi anni, agli attacchi contro aziende come 3CX, Kaseya e SolarWinds, nonché strumenti open source come Log4j e Polyfill.io e proprio per colpire un gran numero dei loro utenti. Al momento comunque, ha sottolineato TechCrunch, “non è chiaro quante persone abbiano scaricato la versione dannosa di Axios in quel lasso di tempo“. L’analisi del Threat Intelligence Group di Google “Abbiamo attribuito l’attacco a un presunto attore di minaccia nordcoreano che monitoriamo con il nome di UNC1069”, ha dichiarato John Hultquist, capo analista del Threat Intelligence Group di Google. “Gli hacker nordcoreani hanno una profonda esperienza negli attacchi alla catena di approvvigionamento, che storicamente hanno utilizzato per rubare criptovalute“. E ancora: “La portata complessiva di questo incidente cyber non è ancora chiara, ma data la popolarità del pacchetto compromesso. Ci aspettiamo che avrà un impatto di vasta portata”.

Threat actors have targeted an open source maintainer to hijack one of the most popular npm packages and spread remote access Trojans (RATs). Axios is a JavaScript library downloaded over 100 million times a week and used as a dependency in countless developer environments and CI/CD pipelines. The threat actors compromised the account of maintainer Jason Saayman, adding the malicious npm package plain-crypto-js as a dependency to axios, according to researchers at OpenSourceMalware. Hinting at the sophistication of the attack, the threat actors apparently staged the malicious dependency the day before the account takeover. They also changed Saayman’s email address on the account for persistence, and hijacked his GitHub account for good measure. “On GitHub, the attacker used admin privileges to unpin and delete an issue reporting the compromise – while collaborator DigitalBrainJS was actively trying to respond,” the OpenSourceMalware report continued. “DigitalBrainJS, lacking admin access, could not revoke jasonsaayman's permissions and had to escalate to npm administration, who removed the malicious versions and revoked all tokens approximately three hours after the attack began.” With access to Saayman’s account, the threat actors published malicious package versions v1.14.1 and v0.30.4 featuring plain-crypto-js to deploy cross-platform RATs. Whereas legitimate axios releases are published via GitHub Actions using OIDC provenance signing, these were apparently published directly via the npm CLI using stolen credentials. Google Flags Extensive Fallout From Axios‑Linked Attack Google has warned that the blast radius of this attack could be extensive, given the number of popular packages with dependencies on axios. Principal threat analyst at Google Threat Intelligence Group (GTIG), Austin Larsen, urged security teams to: Check lockfiles, reviewing package-lock.json, yarn.lock, or pnpm-lock.yaml to see if plain-crypto-js, axios v1.14.1, or axios v0.30.4 are present Hunt for IOCs across developer machines and CI/CD infrastructure Rotate credentials and remediate any exposed systems GTIG has attributed this activity to UNC1069, a financially motivated North Korea-nexus threat actor active since at least 2018. They made this arrtibution based on the use of WAVESHAPER.V2, an updated version of WAVESHAPER previously used by this threat actor. “The multi-stage architecture, platform-specific payloads and comprehensive RAT capabilities demonstrate that attackers are investing significant resources into supply chain attacks," OpenSourceMalware argued. “The use of obfuscation, anti-analysis techniques, and self-deletion shows awareness of modern detection capabilities and an attempt to evade them. The choice to target axios – a package with millions of weekly downloads – indicates an understanding of the npm ecosystem and potential for widespread impact.” Avital Harel, security researcher at Upwind, said that the “build pipeline is becoming the new front line” in the battle against open source threats. “Attackers know that if they can compromise the systems that build and distribute software, they can inherit trust at scale,” she added. “What makes these attacks so dangerous is that they’re targeting the process behind many of them. Organizations should be looking much more closely at CI/CD systems, package dependencies, and developer environments, because that’s increasingly where attackers are placing their bets."

Malicious versions of the highly popular Axios NPM library were distributed to millions in a fresh supply chain attack blamed on North Korean hackers. A promise-based HTTP client that supports asynchronous API requests from Node.js and browsers, Axios is used for fetching, sending, and updating data. With over 100 million weekly downloads, it is a top 10 NPM package and the most popular JavaScript HTTP client library, present in approximately 80% of cloud and code environments. On March 31, 2026, just after midnight, two backdoored Axios versions were published to the NPM registry to automatically execute a payload across Windows, macOS, and Linux systems, without user interaction. The nefarious package versions, namely 1.14.1 and 0.30.4, were removed from the registry roughly three hours later. During this window, they were downloaded by roughly 3% of the Axios userbase, Wiz says. The backdoored iterations contained a phantom dependency that was published to the registry 18 hours before the attack. Named [email protected], the dependency is never imported anywhere by the Axios code. “Its sole purpose is to execute a post-install script that acts as a cross-platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux. The dropper contacts a live command-and-control server and delivers platform-specific second-stage payloads,” StepSecurity notes. The dropped payloads, Wiz explains, had similar functionality across operating systems, enabling remote shell execution, code injection, directory and process enumeration, and system reconnaissance. “After execution, the malware attempts to remove installation artifacts and replaces its own package metadata with a clean version to evade forensic detection,” Sophos says. According to Socket, the @shadanai/openclaw and @qqbrowser/[email protected] packages were seen distributing the same malware. Compromised account and attack timeline The supply chain attack was highly targeted and premeditated, security researchers say. To mount the attack, the threat actors compromised the NPM account of @jasonsaayman, the primary maintainer of Axios, Huntress explains. The attackers changed the email address for the account and used a long-lived access token to publish the backdoor package versions directly via the NPM CLI, bypassing the GitHub Actions OIDC-based CI/CD publishing workflow. “One critical detail: even on the v1.x branch where OIDC Trusted Publishing was configured, the publish workflow still passed NPM_TOKEN as an environment variable alongside OIDC credentials. When both are present, NPM uses the token. This meant the long-lived token was effectively the authentication method for all publishers, regardless of OIDC configuration,” Huntress says. This explains why the attackers could bypass publishing protections even if the maintainer has multi-factor authentication enabled “on practically everything” he interacts with, as he pointed out. A clean version of plain-crypto-js dependency used in the attack was published 18 hours before the attack, “to establish NPM publishing history, so the package does not appear as a zero-history account during later inspection,” StepSecurity notes. The malicious iteration of the dependency was published roughly 20 minutes before the first backdoored Axios version was published. The second backdoored Axios release was pushed 39 minutes later. NPM unpublished and removed the malicious versions three hours later and started a security hold on plain-crypto-js. It replaced the malicious dependency with an NPM security-holder stub an hour later. The initial plain-crypto-js version was an identical copy of the legitimate [email protected] package. The malicious iteration, 4.2.1, contained only three differences: the post-install script, an obfuscated dropper, and a clean JSON stub. The purpose of the stub was to rename itself (after the setup script finished execution and deleted itself) and report version 4.2.0 instead of 4.2.1, to trick defenders into believing that their systems were not compromised, StepSecurity notes. North Korean hackers to blame “The level of operational sophistication documented here, including compromised maintainer credentials, pre-staged payloads built for three operating systems, both release branches hit in under 40 minutes, and built-in forensic self-destruction, reflects a threat actor that planned this as a scalable operation,” said ReversingLabs chief software architect Tomislav Pericin. The attack, cybersecurity researchers say, was mounted by North Korean hackers. Elastic says the macOS binary used in the attack overlaps with WaveShaper, which was attributed by Google to UNC1069. In an emailed statement, Google Threat Intelligence Group chief analyst John Hultquist confirmed the attribution. “GTIG is investigating the Axios supply chain attack, an incident unrelated to the recent TeamPCP supply chain issues. We have attributed the attack to a suspected North Korean threat actor we track as UNC1069,” Hultquist said. “North Korean hackers have deep experience with supply chain attacks, which they’ve historically used to steal cryptocurrency. The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far-reaching impacts,” he added. Active since at least 2018, UNC1069 is a financially motivated threat actor known for targeting cryptocurrency and decentralized finance (DeFi) verticals, software developers, and venture capital firms. In February, Google warned of evolving UNC1069 tactics, techniques, and procedures (TTPs), including the use of new malware families in attacks against a FinTech entity. Downstream impact Impacted users are advised to immediately remove the malicious packages from their systems, to hunt for signs of infection, and to audit their dependency trees for potential downstream impact. “We are already seeing active exploitation. Any environment that installed [email protected] or [email protected] should be treated as compromised. Organizations must immediately audit their dependencies, downgrade to verified safe versions, rotate all credentials accessible during installation, and scan for malware artifacts specific to each operating system,” Huntress senior principal security researcher John Hammond said in an emailed comment. The attack, Sonatype field CTO Ilkka Turunen points out, shows that hackers are now exploiting the trust people place in code rather than in the code itself. “The malicious capability was introduced through a staged dependency and designed to erase its own tracks, which made the attack harder to spot and slower to understand. That’s not just malware — it shows a more deliberate and mature playbook,” Turunen said. “What makes this incident important is how little visible change was needed to create real downstream risk. When a widely trusted package can be turned into a delivery path like this, the issue is bigger than package hygiene. It’s a trust problem in the software supply chain, and it’s why organizations need security controls that look at what’s actually being installed, not just what appears safe at first glance,” he added. Despite the short window of availability for the two backdoored Axios iterations, the impact of this supply chain attack is believed to be broad, as the library is deeply embedded across environments and the malicious code was likely pulled through downstream build pipelines. “By briefly inserting malicious code into a common package, threat actors can exploit routine software updates and automated processes, often without anyone immediately realizing something is wrong. That downstream exposure is what makes these incidents particularly difficult to spot and contain, especially for teams that never directly chose to install Axios themselves,” Arctic Wolf VP Ismael Valenzuela said. “What makes this one worth paying close attention to is the IDE extension angle. Developers who pinned their versions, maintained lockfiles, and followed standard hygiene could still have been hit because their editor pulled the dependency behind the scenes,” Semgrep founder and CEO Isaac Evans pointed out. Related: Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks Related: TeamPCP Moves From OSS to AWS Environments Related: The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust

Google has formally attributed the supply chain compromise of the popular Axios npm package to a financially motivated North Korean threat activity cluster tracked as UNC1069. "We have attributed the attack to a suspected North Korean threat actor we track as UNC1069," John Hultquist, chief analyst at Google Threat Intelligence Group (GTIG), told The Hacker News in a statement. "North Korean hackers have deep experience with supply chain attacks, which they've historically used to steal cryptocurrency. The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far reaching impacts." The development comes after threat actors seized control of the package maintainer's npm account to push two trojanized versions 1.14.1 and 0.30.4 that introduced a malicious dependency named "plain-crypto-js" in order to deliver a cross-platform backdoor capable of infecting Windows, macOS, and Linux systems. Rather than introducing any code changes to Axios, the attack leverages a postinstall hook within the "package.json" file of the malicious dependency to achieve stealthy execution. Once the compromised Axios package is installed, npm automatically triggers the execution of malicious code in the background. Specifically, the "plain-crypto-js" package functions as a "payload delivery vehicle" for an obfuscated JavaScript dropper dubbed SILKBELL ("setup.js"), which fetches the appropriate next-stage from a remote server based on the victim's operating system. As previously detailed by The Hacker News, the Windows execution branch delivers PowerShell malware, a C++ Mach-O binary for macOS, and a Python backdoor for Linux systems. The dropper also performs a cleanup to remove itself and replace the "plain-crypto-js" package's "package.json" file with a clean version that does not have the postinstall hook. The backdoor, codenamed WAVESHAPER.V2, is assessed to be an updated version of WAVESHAPER, a C++ implant deployed by UNC1069 in attacks aimed at the cryptocurrency sector. The threat actor has been operational since 2018. The supply chain attack's links to UNC1069 were first flagged by Elastic Security Labs, citing functionality overlaps. The three WAVESHAPER.V2 variants support four different commands, while beaconing to the command-and-control (C2) server at 60-second intervals - kill, to terminate the malware's execution process. rundir, to enumerate directory listings, along with file paths, sizes, and creation/modification timestamps. runscript, to run AppleScript, PowerShell, or shell commands based on the operating system. peinject, to decode and execute arbitrary binaries. "WAVESHAPER.V2 is a direct evolution of WAVESHAPER, a macOS and Linux backdoor previously attributed to UNC1069," Mandiant and GTIG said. "While the original WAVESHAPER uses a lightweight, raw binary C2 protocol and employs code packing, WAVESHAPER.V2 communicates using JSON, collects additional system information, and supports more backdoor commands." "Despite these upgrades, both versions accept their C2 URL dynamically via command-line arguments, share identical C2 polling behaviors and an uncommon User-Agent string, and deploy secondary payloads to identical temporary directories (e.g., /Library/Caches/com.apple.act.mond)." The links to North Korea are also bolstered by the fact that the macOS binary references developer build paths like "Jain_DEV/client_mac/macWebT/macWebT," where "macWebT" links directly to BlueNoroff's "webT" module from RustBucket and Hidden Risk malware campaigns in 2023 and 2024, according to researcher Giuseppe Massaro. Taylor Long, senior analyst at GTIG, told The Hacker News that the use of supply chain attacks is not a new strategy for threat actors from the Democratic People's Republic of Korea (DPRK). "Several DPRK threat actors have a history of conducting supply chain compromises and leveraging malicious npm packages for cryptocurrency theft, while also continuing to rely on social engineering techniques," Long added. What's currently unclear is the motivation behind the campaign. While UNC1069 is assessed to be financially driven, the attack activity stemming from the compromise of Axios does not explicitly involve cryptocurrency theft or ransomware deployment. "We currently don’t have enough visibility into post-compromise activity to assess their motivation, but given what we know about UNC1069 and how DPRK threat actors are mandated to generate revenue, we're likely to see some financially-motivated attacks to emerge from this," Long said. To mitigate the threat, users are advised to audit dependency trees for compromised versions (and downgrade to a safe version, if found), pin Axios to a known safe version in the "package-lock.json" file to prevent accidental upgrades, check for presence of "plain-crypto-js" in "node_modules," terminate malicious processes, block C2 domain ("sfrclak[.]com," IP address: 142.11.206[.]73), isolate affected systems, and rotate all credentials. "The Axios attack should be understood as a template, not a one-time event. The level of operational sophistication documented here, including compromised maintainer credentials, pre-staged payloads built for three operating systems, both release branches hit in under 40 minutes, and built-in forensic self-destruction, reflects a threat actor that planned this as a scalable operation," ReversingLabs Chief Software Architect Tomislav Peričin told The Hacker News. "If this campaign is now appearing in PyPI and NuGet, that's consistent with what the attack mechanics already suggest: the goal was maximum developer reach. Organizations need to audit not just their npm dependencies, but every package manager feeding their build pipelines, and treat any secrets exposed in affected environments as compromised, regardless of which registry they touched." Update Microsoft has attributed the supply chain compromise to a North Korean state-sponsored threat actor it tracks as Sapphire Sleet (aka CryptoCore or CageyChameleon), an offshoot of BlueNoroff (aka Alluring Pisces, APT38, Black Alicanto, Copernicium, Nickel Gladstone, Stardust Chollima, and TA444). It's assessed to be active since at least March 2020. "The threat actor focuses primarily on the finance sector, including cryptocurrency, venture capital, and blockchain organizations," the company said. "The primary motivation of this actor is to steal cryptocurrency wallets to generate revenue, and target technology or intellectual property related to cryptocurrency trading and blockchain platforms." CrowdStrike, in its report, linked the incident to Stardust Chollima with moderate confidence based on the deployment of an updated variant of ZshBucket, a macOS malware previously identified as exclusively used by the adversarial collective. "The observed macOS variant in this case extensively reuses code from previous instances, including function names," it said. "All variants retain characteristics of previous instances, including how it profiles the user and host of the operating system, and how it sends the collected information." The new version of ZshBucket also iterates over the predecessor's functionality by implementing a common JSON-based messaging protocol for all platform-specific instances and adding commands that make it possible to binary payloads, execute arbitrary scripts and commands, enumerate the file system, and remotely terminate the implant. According to the cybersecurity company, the supply chain attack leveraging updated ZshBucket variants is part of broader efforts undertaken by the threat actor to scale its campaigns. This is significant, not least because Stardust Chollima has demonstrated an increased operational tempo since the end of Q4 2025. "Stardust Chollima's operations prioritize currency generation and regularly target cryptocurrency holders, and the adversary has also conducted widespread supply chain compromises impacting fintech companies' npm and PyPI repositories," it added. "The adversary's motivation probably aligns with this currency generation objective." Veracode has since found evidence of possible spread via a mirrored package named "@depup/axios" that republished the compromised Axios version (1.14.1) just 17 minutes after its release. "This indicates that the malware was quickly copied and spread by automated systems before it could be removed, possibly expanding its reach beyond npm itself," the company said in a statement shared with The Hacker News. "It also underscores that even short-lived supply chain attacks may persist through affected packages." Additional analyses of the Axios supply chain incident, along with indicators of compromise, have been published by various security vendors - "The Axios npm compromise serves as a stark reminder of the compounding nature of supply chain attacks," Aaron Walton, senior threat intel analyst at Expel, told The Hacker News. "When a core package is compromised, the threat surface expands exponentially to include every downstream dependency, application, and environment that relies on it." "High-profile incidents in March alone, including Trivy and LiteLLM, underscore the increasing frequency and severity of these exploits. While the cybersecurity community and maintainers are accelerating their response times, even a narrow window of exposure can lead to catastrophic data loss. Supply chain compromises are no longer 'outlier' events; they're a persistent reality. Organizations must shift from reactive response to proactive defense to protect their own data." (The story was updated on April 3, 2026, to reflect the latest developments.)

Google links axios supply chain attack to North Korean group Hackers connected to North Korea are responsible for the recent compromise of a wildly popular library used in both front-end apps and back-end systems, according to new researcher. On Monday evening, news emerged that hackers launched a supply chain attack targeting the HTTP client axios, which is downloaded 100 million times each week and embedded across frontend frameworks, backend services and enterprise applications. Google Threat Intelligence Group (GTIG) joined several other researchers in attributing the attack to a North Korean threat actor they call UNC1069. SentinelOne found the same group using macOS-based malware in attacks dating back to 2023. Last month, the financially-motivated group was accused of targeting a cryptocurrency company with several unique pieces of malware deployed alongside multiple scams, including a fake Zoom meeting. Several other researchers backed Google’s assessment because the backdoors used during the axios attack resemble WAVESHAPER, a strain of malware North Korean actors used during the fake Zoom campaign. John Hultquist, chief analyst at Google Threat Intelligence Group, said the axios incident is unrelated to another recent supply chain attack that caused alarm among security experts due to its widespread nature. Hultquist noted that North Korean hackers “have deep experience with supply chain attacks, which they’ve historically used to steal cryptocurrency.” A 2023 supply-chain attack on the enterprise phone company 3CX was attributed to North Korean hackers. “The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far reaching impacts,” Hultquist said. Experts raised alarms early on Tuesday morning when two malicious versions of the axios package were published on the Node Package Manager (npm). Security companies Socket and StepSecurity confirmed the packages were malicious and traced the incident back to the hijacking of the lead axios maintainer’s npm account. Socket said the malicious package deploys a multi-stage payload, including a “remote access trojan (RAT) capable of executing arbitrary commands, exfiltrating system data, and persisting on infected machines.” “When the attack first happened, axios maintainers were unable to regain control of the project. In a public GitHub issue, a collaborator stated they could not revoke access from the account responsible for the malicious publish, noting that the attacker’s permissions exceed their own,” Socket explained. Axios is among the most popular JavaScript HTTP client libraries and is used by developers to connect apps to the internet. StepSecurity said that this is “among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package.” The malicious version injects a new dependency that installs the malware, which impacts Windows, macOS and Linux. After executing, the malware deletes itself and replaces it with a clean version of the tool to evade detection, StepSecurity added. “There are zero lines of malicious code inside axios itself, and that's exactly what makes this attack so dangerous,” the researchers said. The incident marks the latest in a string of compromises involving the software supply chain, which is increasingly tied together through code pulled in from outside sources. Last week’s attack on the widely used open-source Python package LiteLLM allowed cybercriminals to breach several organizations. Previous incidents involving XZ Utils and self-replicating worm Shai-Hulud stood out among a sea of research uncovering more and more npm packages that have been corrupted. Mandiant CTO Charles Carmakal said the number of recent software supply chain attacks is overwhelming. “The secrets stolen over the past two weeks will enable more software supply chain attacks, software-as-a-service environment compromises (leading to downstream customer compromises), ransomware and extortion events, and crypto heists over the next several days, weeks, and months,” he said. “We are aware of hundreds of thousands of stolen credentials. A variety of actors with varied motivations are behind these attacks. The blast radius of yesterday's axios npm supply chain attack is broad and extends to other popular packages that have dependencies on it.” Mike Puglia, a security leader at Kaseya, said the incidents are further evidence of the fragility of the world's software ecosystem. “In this case, the attacker compromised one single account, the maintainer of axios, and the malicious code was ‘live’ for almost three hours before discovery. On a typical day, that could mean tens of thousands of organizations received the malware,” Puglia said. To further complicate matters, after the attacker's remote access was deployed, the malware replaced itself with the legitimate axios files, making it difficult to know if you were compromised, he added. Several other experts warned that the recent attacks on axios and LiteLLM would be templates for other hackers to replicate. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Researchers found that compromised Axios versions installed a Remote Access Trojan. Axios is a promise-based HTTP Client for node.js, basically a helper tool that developers use behind the scenes to let apps talk to the internet. For example, Axios makes requests such as “get my messages from the server” or “send this form to the website” easier and more reliable for programmers and it saves them from having to write a lot of low‑level networking code themselves. Since it works both in the browser and on servers (Node.js), a lot of modern JavaScript‑based projects include it as a standard building block. Even if you never install Axios yourself, you might indirectly run into it when you: Use web apps built with frameworks like React, Vue, or Angular. Use mobile apps or desktop apps built with web technologies like Electron, React Native, and others. Visit smaller Software-as-a-Service (SaaS) tools, admin panels, or self‑hosted services built by developers who picked Axios. You could compare it to the plumbing in your house. Usually you don’t notice the pipes, but they bring the water to where you open a faucet. And you don’t need to know where they are until a leak occurs. What happened? Using compromised credentials of a lead maintainer of Axios an attacker published poisoned packages to npm: [email protected] and [email protected]. The malicious versions inject a new dependency, [email protected], which is never imported anywhere in the axios source code. Together the two affected packages reach up to 100 million weekly downloads on npm, which means it has a huge impact radius across web apps, services, and pipelines. It is important to note that the affected Axios version does not appear in the project’s official GitHub tags. This means that the people and projects affected are developers and environments which ran npm install that resolved to: [email protected] [email protected] , or the dependency [email protected] . Any workflow that installed one of those versions with scripts enabled may have exposed all injected secrets (cloud keys, repo deploy keys, npm tokens, etc.) to an interactive attacker, because the postinstall script (node setup.js) that runs automatically on npm install downloaded an obfuscated dropper that retrieves a platform‑specific RAT payload for macOS, Windows, or Linux. If you are a developer deploying Axios, treat any machine that installed the bad versions as potentially fully compromised and rotate secrets. The attacker may have obtained repo access, signing keys, API keys, or other secrets that can be used to backdoor future releases or attack your backend and users. Users apps built with Axios do not have any direct reason to worry. If you’re just loading your app in a browser you’re not directly executing this RAT via Axios. The infection path is the install/build step, not app runtime. Indicators of Compromise (IOCs) As the rsearchers pointed out the malware dropper cleans up after itself: “Any post-infection inspection of node_modules/plain-crypto-js/package.json will show a completely clean manifest. There is no postinstall script, no setup.js file, and no indication that anything malicious was ever installed. Running npm audit or manually reviewing the installed package directory will not reveal the compromise.” What you can look for, then, are these IOCs: Domain: sfrclak[.]com IP address: 142.11.206.73 (both blocked by Malwarebytes products) Files: macOS: /Library/Caches/com.apple.act.mond Linux: /tmp/ld.py Windows: %PROGRAMDATA%\wt and %TEMP%\6202033.vbs/.ps1 which only exist briefly during execution Malicious npm packages: [email protected] sha-256 checksum: 2553649f2322049666871cea80a5d0d6adc700ca [email protected] sha-256 checksum: d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 [email protected] sha-256 checksum: 07d889e2dadce6f3910dcbc253317d28ca61c766 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Supply Chain Attack: compromissione del pacchetto NPM Axios Bollettino BL01/260331/CSIRT-ITA Sintesi È stata recentemente rilevata la compromissione della supply chain che ha interessato Axios, libreria JavaScript largamente utilizzata che fa da client HTTP per effettuare richieste verso API e servizi web. L'attacco, dovuto alla compromissione (hijacking) dell'account di un’utenza maintainer, ha permesso la pubblicazione sul registro NPM di versioni opportunamente predisposte, che integravano un malware dropper. Tali versioni sono progettate per installare un Remote Access Trojan (RAT) su sistemi Windows, macOS e Linux. Tipologia Remote Code Execution Descrizione dell’incidente L’evento è scaturito dalla compromissione (hijacking) dell'account NPM di uno dei maintainer del progetto Axios. L'attaccante, dopo aver acquisito il controllo dell'utenza e averne modificato l'indirizzo e-mail (passando a un provider crittografato ProtonMail), ha pubblicato manualmente, sul registro NPM, le versioni malevole 1.14.1 (per il ramo stabile 1.x) e 0.30.4 (per il ramo legacy 0.x). Tale operazione ha permesso l’elusione della pipeline di rilascio automatizzata su GitHub Actions e i relativi controlli basati su OIDC (OpenID Connect Trusted Publishing), infrangendo la catena di fiducia tra codice sorgente verificato e pacchetto distribuito. Vettore di Infezione e Payload Si evidenzia che la scelta dell'attaccante è stata quella di non alterare il codice sorgente del pacchetto Axios, utilizzando una tecnica di shadow injection che ha permesso di eludere i controlli di analisi statica (SAST) e le revisioni manuali dei diff tra le versioni. Nel dettaglio all'interno di tali versioni, l'attaccante ha iniettato una singola dipendenza malevola: [email protected], che sfrutta la funzionalità automatica di postinstall di NPM per lanciare istantaneamente uno script (setup.js) durante l'installazione della libreria. Lo script, fortemente offuscato per eludere l'analisi dinamica, contatta un server di Command and Control (C2) identificando il sistema operativo della vittima e scaricando payload specifici di secondo livello, per Windows, macOS o Linux. Completata l'installazione silente del Remote Access Trojan (RAT), il malware avvia routine di auto-eliminazione del dropper e ripristina lo stato originale dei file di configurazione del progetto (come package.json e i file di lock). Rimuovendo ogni riferimento alla dipendenza malevola plain-crypto-js dalla directory node_modules, il malware rende l'infezione invisibile ai comuni strumenti di auditing locale, garantendo la persistenza silenziosa a livello di sistema operativo. La diffusione delle versioni compromesse è stata interrotta tramite l'intervento del registro NPM, che ha provveduto al "ritiro forzato" (unpublish) delle versioni malevole di Axios (1.14.1 e 0.30.4). Contestualmente, il pacchetto plain-crypto-js è stato rimosso e sostituito con un security stub[1] per inibirne il download e l'esecuzione automatica. Potenziali Impatti 1. Data Breach: esfiltrazione di variabili d'ambiente, file di configurazione cloud (AWS, Azure, GCP), token di autenticazione e chiavi SSH. 2. Compromissione CI/CD: l'infezione di un runner permette all'attaccante di iniettare codice malevolo in altri progetti o manipolare gli artefatti finali (immagini Docker, binari), estendendo la compromissione alla supply chain dei propri clienti. 3. Lateral Movement: impiego delle informazioni carpite per ottenere l'accesso a risorse interne, database o segmenti di rete protetti, eludendo eventuali controlli grazie alla fiducia intrinseca degli ambienti di sviluppo. 4. Rischio Persistenza: la semplice eliminazione della directory node_modules o la rimozione del pacchetto Axios non elimina l'infezione, che rimane attiva e silente come processo di sistema indipendente. Prodotti e versioni affette axios - stable (1.x), versione 1.14.1 axios - legacy (0.x), versione 0.30.4 Pacchetti correlati @shadanai/openclaw, versioni 2026.3.28-2, 2026.3.28-3, 2026.3.31-1 e 2026.3.31-2 @qqbrowser/openclaw-qbot, versione 0.0.130 Azioni di mitigazione Gli utenti e le organizzazioni possono far fronte a questa tipologia di attacchi valutando l’implementazione delle misure di mitigazione raccomandate riportate di seguito: Audit: verificare nelle dipendenze (package-lock.json , o altri) la presenza delle versioni compromesse 1.14.1 o 0.30.4; Downgrade e Cache: forzare il ritorno a una versione stabile (ad esempio 1.7.9) e svuotare la cache di sistema con il comando npm cache clean –force (o comandi equivalenti); Rotazione di Credenziali e Token: revocare e rigenerare chiavi API, token cloud (AWS/Azure/GCP) e chiavi SSH presenti sulle macchine o nei runner CI/CD coinvolti; Bonifica Host: considerare ogni sistema che ha eseguito l'installazione del pacchetto in oggetto, come compromesso. La persistenza del malware a livello di sistema operativo richiede la formattazione o il ripristino dell'immagine degli host (laptop o server di build) interessati. Per verificare l’eventuale compromissione dei propri sistemi si raccomanda di valutare l’utilizzo dei meccanismi di rilevamento riportati al seguente link, nella sezione “Am I Affected?”. Infine, si raccomanda di valutare l’implementazione sui propri apparati di sicurezza degli Indicatori di Compromissione (IoC)[2] presenti nei link disponibili nella sezione Riferimenti. Security Stub: pacchetto segnaposto (placeholder) privo di codice funzionale, pubblicato dai gestori del registro NPM in sostituzione di un pacchetto rimosso per motivi di sicurezza. Lo scopo dello stub è inibire il download della versione malevola e generare un errore o un avviso di sicurezza esplicito qualora un sistema tenti di risolvere tale dipendenza, impedendo così la propagazione del malware e l'esecuzione di script dannosi (come i postinstall) legati al pacchetto originale. Per definizione, non tutti gli indicatori di compromissione sono malevoli. Questo CSIRT non ha alcuna responsabilità per l'attuazione di eventuali azioni proattive (es. inserimento degli IoC in blocklist) relative agli indicatori forniti. Le informazioni contenute in questo documento rappresentano la migliore comprensione della minaccia al momento del rilascio.

Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver remote access trojans to Linux, Windows, and macOS systems. According to reports from software supply chain security and application security companies Endor Labs, Socket, Aikido, and StepSecurity, the threat actor published on the Node Package Manager (npm) registry two malicious versions of the package One malicious variant, [email protected], was published today at 00:21 UTC, while the second one, [email protected], emerged less than an hour later, at 01:00 UTC. The packages were published without the automated OpenID Connect (OIDC) package origin and no matching GitHub commit appeared, which should trigger an alert immediately. The researchers say that the threat actor gained access to the package after compromising the npm account of Jason Saayman, the main Axios maintainer. The OpenSourceMalware research community says that the attacker also took control of Saayman's GitHub account and changed the associated email to [email protected], then removed a report about the compromise to which project collaborator DigitalBrainJS was trying to reply. It is unclear how many downstream projects have been impacted by the supply-chain attack during the nearly three-hour exposure window. Given that the Axios npm package has around 400 million monthly downloads, the number may be significant. Axios is an HTTP client for JavaScript applications that manages requests between clients, such as browsers or Node.js apps, and servers. Its purpose is to simplify communication via GET, POST, PUT/PATCH, and DELETE requests. Infection chain After getting access to the package, the attacker injected a malicious dependency called plain-crypto-js@^4.2.1 into the package.json file and did not alter the Axios code. The dependency executes a post-install script during the package’s installation, launching an obfuscated dropper (setup.js) that contacts a command-and-control (C2) server to retrieve a next-stage payload based on the detected operating system. On Windows, the attack mixes VBScript and PowerShell to run a hidden Command Prompt window and execute a malicious script. The malware copies PowerShell to %PROGRAMDATA%\wt.exe to evade detection and achieve persistence across reboots, then downloads and executes a PowerShell script. On macOS, the malware uses AppleScript to download a binary to /Library/Caches/com.apple.act.mond, mark it as executable, and run it in the background. On Linux systems, the dropper fetches a Python-based payload stored at ‘/tmp/ld.py’ and executes it in the background with the nohup (no hang up) command. In all cases, the malware infected the host with a remote access trojan (RAT), allowing attackers to execute commands and maintain persistence on infected systems. The RAT can retrieve and execute a base64-encoded binary that it writes in a hidden temp file, execute shell commands via /bin/sh or AppleScript, and enumerate directories on the infected host. After the infection is completed, the dropper deletes itself, removes the modified package.json, and replaces it with a clean copy to make forensic investigations more difficult. According to researchers at StepSecurity, the Axios supply-chain attack was not opportunistic, but a carefully planned activity, as "the malicious dependency was staged 18 hours in advance." The fact that different payloads were delivered based on the detected operating system appears to support this theory, along with the self-destruct action for every artifact. John Hultquist, chief analyst at Google Threat Intelligence Group (GTIG) told BleepingComputer that behind the Axios package compromise is a North Korean actor tracked internally as UNC1069 and known to target "centralized exchanges (CEX), software developers at financial institutions, high-technology companies, and individuals at venture capital funds." A security researcher says that the macWebT name of the macOS RAT is a direct reference to malware used by the BlueNoroff hackers in campaigns observed by SentinelOne in 2023. BlueNoroff is a North Korean threat group specialized in financially-motivated cyberattacks. The actor has targeted banks, financial institutions, and cryptocurrency exchanges. Currently, there is no clear information about the threat actor behind the Axios supply-chain attack. Recently, several high-profile supply-chain attacks were claimed by a group known as TeamPCP. The hackers targeted popular open-source software projects like Telnyx, LiteLLM, and Trivy. However, the compromise of the Axios package does not have the characteristics of a TeamPCP attack, and security researchers couldn’t link it to a specific threat actor. Indicators of compromise (IoCs) are available from multiple organizations investigating the Axios supply-chain compromise and include the C2 domain used in the attack, sfrclak.com and other network details along with file system, packages data, and accounts observed in the attack: Security teams are recommended to check environments for the presence of [email protected], [email protected], or any version of plain-crypto-js and treat the system as compromised if any of them is detected. Axios should resolve to versions 1.14.0 or 0.30.3, or downgraded to an earlier version confirmed to be safe. Joe DeSimone of Elastic advises rotating credentials on systems running a compromised version of the Axios package, as the malware may have exfiltrated sensitive data such as keys and tokens. Charles Carmakal, chief technology officer at Mandiant, says that the Axios npm supply-chain attack "is broad and extends to other popular packages that have dependencies on it." The researcher warns that the amount of recent supply-chain incidents is overwhelming and that the secrets stolen this way over the past two weeks will lead to more compromises, crypto theft, ransomware, and extortion events. "We are aware of hundreds of thousands of stolen credentials. A variety of actors with varied motivations are behind these attacks," Carmakal says. Update [March 31, 13:09 EST]: Article updated with information about indicators of compromise and reference to potential BlueNoroff connection. Update [March 31, 14:22 EST]: Added attribution information and comments from Charles Carmakal and John Hultquist. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Axios npm packages backdoored in supply chain attack An unknown attacker has compromised the GitHub and npm accounts of the main developer of Axios, a widely used HTTP client library, and published npm packages backdoored with a malicious dependency that triggered the installation of droppers and remote access trojans. How the attack unfolded On March 30, 2026, with an account using a separate throwaway ProtonMail address, the attacker published on NPM a trojanized copy of the popular crypto-js JavaScript library of crypto standards. This malicious [email protected] package was designed to look legitimate, but contained a postinstall script/hook that executes automatically on every npm install. Then, in the early hours (UTC) of March 31, 2026, the attacker used the compromised Axios maintainer account (on which they changed the email to another ProtonMail address to lock out Jason Saayman, the rightful owner), and published backdoored axios releases in relatively quick succession. These malicious packages – [email protected] and [email protected] – contained [email protected] as a runtime dependency. “When a developer runs npm install [email protected] [or [email protected]], npm resolves the dependency tree and installs [email protected] automatically. npm then executes plain-crypto-js’s postinstall script, launching the dropper [setup.js],” Step Security researchers explained. “The dropper contacts a live command-and-control server, delivers separate second-stage payloads for macOS, Windows, and Linux, then erases itself and replaces its own package.json [configuration file] with a clean decoy, leaving a developer who inspects their node_modules folder after the fact with no indication anything went wrong.” According to OpenSourceMalware, the entire process, from installation to full compromise, took approximately 15 seconds. What to do if you installed the backdoored Axios npm versions Developers who have installed [email protected] or [email protected] should assume their system has been compromised and should isolate it from the network. Step Security advises: Searching for malicious axios versions in their project Checking for plain-crypto-js in node_modules (i.e., the folder in a JavaScript project that contains all the installed packages their app needs to run). Its presence means the dropper run. Checking for the presence of the system-specific RAT on their system (/Library/Caches/com.apple.act.mond on macOS, %PROGRAMDATA%\wt.exe on Windows, /tmp/ld.py on Linux). “If a RAT artifact is found: treat the system as fully compromised. Do not attempt to clean in place – rebuild from a known-good state,” the researchers added. “Rotate all credentials on any system where the malicious package ran: npm tokens, AWS access keys, SSH private keys, cloud credentials (GCP, Azure), CI/CD secrets, and any values present in .env files accessible at install time.” They also advised the developer community to: Downgrade axios to a clean version (1.14.0 or 0.30.3) and pin it Add an overrides block to prevent transitive resolution back to the malicious versions Remove plain-crypto-js from node_modules Audit CI/CD pipelines for runs that installed the affected versions and rotate secrets for any workflow that executed them use –ignore-scripts in CI/CD to prevent postinstall hooks from running during automated builds Block known malicious C2 traffic to/from 142.11.206.73 and sfrclak.com. Widespread impact The malicious Axios NPM packages were live for approximately 2 hours 53 minutes and 2 hours 15 minutes, the researches said. “Although the malicious versions were removed within a few hours, axios’s widespread usage – present in ~80% of cloud and code environments and downloaded ~100 million times per week – enabled rapid exposure, with observed execution in 3% of affected environments,” Wiz researchers noted. The extensive system reconnaissance, file enumeration, and process monitoring indicate intelligence gathering operations, credential harvesting, source code theft, and preparation for lateral movement, according to OpenSourceMalware. The absence of cryptocurrency mining or ransomware components indicates that this is not financially motivated cybercrime, but rather espionage or advanced persistent threat (APT) activity. This compromise comes just days after financially-motivated TeamPCP effected a series of cascading supply chain attacks that targeted Aqua’s Trivy security scanner, CheckMarx’s VS Code extensions, LiteLLM, and Telnyx. UPDATE (March 31, 2026, 04:30 p.m. ET): “Google Threat Intelligence Group (GTIG) is investigating the axios supply chain attack, an incident unrelated to the recent TeamPCP supply chain issues. We have attributed the attack to a suspected North Korean threat actor we track as UNC1069,” John Hultquist, Chief Analyst with GTIG, told Help Net Security. “North Korean hackers have deep experience with supply chain attacks, which they’ve historically used to steal cryptocurrency. The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far reaching impacts.” Mandiant CTO Charles Carmakal noted that the secrets stolen in the various supply chain attacks over the past two weeks “will enable more software supply chain attacks, SaaS environment compromises (leading to downstream customer compromises), ransomware and extortion events, and crypto heists over the next several days, weeks, and months.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency that delivers a trojan capable of targeting Windows, macOS, and Linux systems. Versions 1.14.1 and 0.30.4 of Axios have been found to inject "plain-crypto-js" version 4.2.1 as a fake dependency. According to StepSecurity, the two versions were published using the compromised npm credentials of the primary Axios maintainer ("jasonsaayman"), allowing the attackers to bypass the project's GitHub Actions CI/CD pipeline. "Its sole purpose is to execute a postinstall script that acts as a cross-platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux," security researcher Ashish Kurmi said. "The dropper contacts a live command and control server and delivers platform-specific second-stage payloads. After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection." Users who have Axios versions 1.14.1 or 0.30.4 installed are required to rotate their secrets and credentials with immediate effect, and downgrade to a safe version (1.14.0 or 0.30.3). The malicious versions, as well as "plain-crypto-js," are no longer available for download from npm. With more than 83 million weekly downloads, Axios is one of the most widely used HTTP clients in the JavaScript ecosystem across frontend frameworks, backend services, and enterprise applications. "This was not opportunistic," Kurmi added. "The malicious dependency was staged 18 hours in advance. Three separate payloads were pre-built for three operating systems. Both release branches were hit within 39 minutes. Every trace was designed to self-destruct." The timeline of the attack is as follows - March 30, 2026, 05:57 UTC - A clean version of the package "[email protected]" is published. March 30, 2026, 23:59 UTC - A new version ("[email protected]") with the payload added is published. March 31, 2026, 00:21 UTC - A new version of Axios ("[email protected]") that injects "[email protected]" as a runtime dependency is published using the compromised "jasonsaayman" account. March 31, 2026, 01:00 UTC - A new version of Axios ("[email protected]") that injects "[email protected]" as a runtime dependency is published using the compromised "jasonsaayman" account. According to StepSecurity, the threat actor behind the campaign is said to have compromised the npm account of "jasonsaayman" and changed its registered email address to a Proton Mail address under their control ("[email protected]"). The "plain-crypto-js" was published by an npm user named "nrwise" with the email address "[email protected]." It's believed that the attacker obtained a long-lived classic npm access token for the account to take control and directly publish poisoned versions of Axios to the registry. The embedded malware, for its part, is launched via an obfuscated Node.js dropper ("setup.js") and is designed to branch into one of three attack paths based on the operating system - On macOS, it runs an AppleScript payload to fetch a trojan binary from an external server ("sfrclak.com:8000"), save it as "/Library/Caches/com.apple.act.mond," change its permissions to make it executable, and launch it in the background via /bin/zsh. The AppleScript file is deleted after execution to cover up the tracks. On Windows, it locates the PowerShell binary path, copies it to the "%PROGRAMDATA%\wt.exe" (disguising it as the Windows Terminal app), and writes a Visual Basic Script (VBScript) to the temp directory and executes it. The VBScript contacts the same server to fetch a PowerShell RAT script and execute it. The downloaded file is then deleted. On other platforms (e.g., Linux), the dropper runs a shell command via Node.js’s execSync to fetch a Python RAT script from the same server, save it to "/tmp/ld.py," and execute it in the background using the nohup command. "Each platform sends a distinct POST body to the same C2 URL — packages.npm.org/product0 (macOS), packages.npm.org/product1 (Windows), packages.npm.org/product2 (Linux)," StepSecurity said. "This allows the C2 server to serve a platform-appropriate payload in response to a single endpoint." The downloaded second-stage binary for macOS is a C++ RAT that fingerprints the system and beacons to a remote server every 60 seconds to retrieve commands for subsequent execution. It supports capabilities to run additional payloads, execute shell commands, enumerate the file system, and terminate the RAT. SafeDep's analysis of the Linux RAT has revealed that it supports the same commands as its macOS counterpart. The absence of a persistence mechanism means that the malware does not survive across reboots. This indicates that the attack is either geared towards quick data exfiltration or leverages the RAT's ability to run binaries and shell commands to deploy persistence. "The attack is notable for its restraint. No Axios source files were modified, making traditional diff-based code review less likely to catch it," SafeDep said. "The malicious behavior lives entirely in a transitive dependency, triggered automatically by npm's postinstall lifecycle." The PowerShell RAT targeting Windows is no different in that it also facilitates the same functionality to execute arbitrary DLLs in memory, run PowerShell commands, list directories with file metadata, and gracefully kill itself. Unlike the macOS and Linux variants, the RAT creates "%PROGRAMDATA%\system.bat" with a download cradle that re-fetches the malware from the server on every login and adds a Registry Run key pointing to the batch script. "On every compromised host, the RAT performed immediate system reconnaissance: enumerating user directories, filesystem drive roots, and running processes, and transmitted this data to the C2," Huntress researcher John Hammond said. "The RAT maintained a 60-second beacon loop, ready to accept further commands including arbitrary script execution and in-memory binary injection." As Elastic Security Labs pointed out, the attack makes use of three parallel implementations of the same RAT – PowerShell for Windows, compiled C++ for macOS, Python for Linux – that shares an identical C2 protocol, command set, message format, and operational behavior. "The consistency strongly indicates a single developer or tightly coordinated team working from a shared design document," the company said. Once the main payload is launched, the Node.js malware also takes steps to perform three forensic cleanup steps by removing the postinstall script from the installed package directory, deleting the "package.json" the references the postinstall hook to launch the dropper, and renaming "package.md" to "package.json." It's worth noting that the "package.md" file is included in "plain-crypto-js" and is a clean "package.json" manifest without the postinstall hook that triggers the entire attack. In switching the package manifests, the idea is to avoid raising any red flags during post-infection inspection of the package. "Neither malicious version contains a single line of malicious code inside Axios itself," StepSecurity said. "Instead, both inject a fake dependency, [email protected], a package that is never imported anywhere in the Axios source, whose only purpose is to run a postinstall script that deploys a cross-platform remote access trojan (RAT)." It's currently not known who is behind the supply chain compromise, but Elastic said the macOS Mach-O binary delivered by the "plain-crypto-js" postinstall hook exhibits significant overlap with WAVESHAPER, a C++ backdoor tracked by Google-owned Mandiant last month and attributed to a North Korean threat actor known as UNC1069. Users are advised to perform the following actions to ascertain compromise - Check for the malicious Axios versions. Check for RAT artifacts: "/Library/Caches/com.apple.act.mond" (macOS), "%PROGRAMDATA%\wt.exe" (Windows), and "/tmp/ld.py" (Linux). Downgrade to Axios versions 1.14.0 or 0.30.3. Remove "plain-crypto-js" from the "node_modules" directory. If RAT artifacts are detected, assume compromise and rotate all credentials on the system. Audit CI/CD pipelines for runs that installed the affected versions. Block egress traffic to the command-and-control domain ("sfrclak[.]com") Socket, in its own analysis of the attack, said identified two additional packages distributing the same malware through vendored dependencies - @shadanai/openclaw (versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, and 2026.3.31-2) @qqbrowser/openclaw-qbot (version 0.0.130) In the case of "@shadanai/openclaw," the package vendors the malicious "plain-crypto-js" payload directly (e.g., @shadanai/openclaw/files/2026.3.31-1/dist/extensions/slack/node_modules/plain-crypto-js/setup.js). On the other hand, "@qqbrowser/[email protected]," ships a tampered "[email protected]" in its "node_modules/" folder with "plain-crypto-js" injected as a dependency. "The real axios has only three dependencies (follow-redirects, form-data, proxy-from-env)," the supply chain security company said. "The addition of plain-crypto-js is unambiguous tampering. When npm processes this vendored axios, it installs plain-crypto-js and triggers the same malicious postinstall chain."

On Friday the US Pentagon cut ties with Anthropic, the company behind Claude AI. Defense Secretary Pete Hegseth designated the San Francisco-based company a “supply-chain risk to national security.” The supply-chain risk designation means that no contractor, supplier, or partner doing business with the US military can deal with Anthropic. The label previously applied only to foreign adversaries like Huawei, though, and using it against a US company marks a rare escalation in a government-industry dispute. According to reports, President Donald Trump also ordered every federal agency to stop using Anthropic’s technology. What Anthropic wouldn’t budge on Anthropic called the designation “unlawful and politically motivated” and said it intends to challenge it in court. At the center of the dispute is how far Anthropic believes its models should be allowed to go inside military systems. Anthropic, which was the first frontier AI company deployed on the military’s classified networks, wanted two contractual restrictions on its AI model Claude, as outlined in its response to the Pentagon’s announcement. It forbade the Pentagon to use its tech for the mass domestic surveillance of Americans and did not want its tech employed in fully autonomous weapons. The Pentagon had previously demanded that all AI vendors agree to “all lawful purposes” language as part of their contracts. Anthropic told ABC that what the Pentagon finally offered left the door open for the government to violate the company’s no-surveillance and no-weapons clauses. Defense Secretary Hegseth responded with a statement cancelling Anthropic’s $200m Pentagon contract, awarded last July. He accused Anthropic of attempting to seize veto power over military operations and called the company’s position fundamentally incompatible with American principles. Anthropic’s CEO Dario Amodei called the government’s response retaliatory and punitive and promised to challenge the designation in court. Legal scholars suggest that the AI company could have a strong case, questioning whether Hegseth can meet the statutory requirements for such a designation, which is allegedly intended to protect military systems from adversarial sabotage rather than resolving a commercial disagreement over contract terms. Dan W. Ball, senior fellow at the American Foundation for Innovation, called the Pengaton’s move “attempted corporate murder,” arguing that Google, Amazon, and NVIDIA would have to detach themselves from Anthropic if Hegseth got his way. Amazon is Anthropic’s primary cloud computing provider, but it also uses Google’s data centers extensively. Both companies are investors in Anthropic, as is NVIDIA, which also partners with the AI company on GPU engineering. If the Pentagon’s designation restricts federal contractors from integrating Anthropic technology into defense-related systems, those partners could be required to separate or ringfence any federal-facing work involving the company. OpenAI steps in In a whirlwind of policy changes by the US military, the Pentagon also signed a deal with ChatGPT creator OpenAI on Friday evening, just a few hours after dropping Anthropic. OpenAI CEO Sam Altman said the agreement preserved the same principles Anthropic had been blacklisted for defending. The difference, according to Altman, is the enforcement mechanism. Instead of hard contractual prohibitions, OpenAI accepted the “all lawful purposes” framework but layered on architectural controls: cloud-only deployment, a proprietary safety stack the Pentagon agreed not to override, and cleared engineers embedded forward. OpenAI said these protections made the company confident that the Pentagon couldn’t cross the red lines it shares with Anthropic. Altman reportedly said Anthropic’s approach differed because it relied on specific contract language rather than existing legal protections, adding Anthropic “may have wanted more operational control than we did.” The morning after The policy dispute did not immediately change how existing systems were operating. According to reporting by The Wall Street Journal and Axios, US Central Command used Anthropic’s AI during Operation Epic Fury, a coordinated US–Israeli operation targeting Iran. The outlets reported that the system was used for intelligence assessment, target analysis, and operational modeling. Claude remained in use because it was already embedded in certain classified military systems. As a senior defense official previously told Axios: “It will be an enormous pain in the ass to disentangle, and we are going to make sure they pay a price for forcing our hand like this.” Hegseth announced a six-month period during which the Pentagon will pick Anthropic’s AI out of its systems. Consumers vote with their feet The dispute has also prompted reactions from some AI industry employees and users. More than 875 employees across Google and OpenAI signed an open letter backing Anthropic’s stance. According to the letter: “They’re trying to divide each company with fear that the other will give in. That strategy only works if none of us know where the others stand.” A consumer boycott, organized under the name QuitGPT, is organizing a campaign to avoid using ChatGPT, along with a protest at OpenAI’s HQ this week. Claude also rocketed to the top of Apple’s App Store over the weekend. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Anthropic on Friday hit back after U.S. Secretary of Defense Pete Hegseth directed the Pentagon to designate the artificial intelligence (AI) upstart as a "supply chain risk." "This action follows months of negotiations that reached an impasse over two exceptions we requested to the lawful use of our AI model, Claude: the mass domestic surveillance of Americans and fully autonomous weapons," the company said. "No amount of intimidation or punishment from the Department of War will change our position on mass domestic surveillance or fully autonomous weapons." In a social media post on Truth Social, U.S. President Donald Trump said he was ordering all federal agencies to phase out the use of Anthropic technology within the next six months. A subsequent X post from Hegseth mandated that all contractors, suppliers, and partners doing business with the U.S. military cease any "commercial activity with Anthropic" effective immediately. "In conjunction with the President's directive for the Federal Government to cease all use of Anthropic's technology, I am directing the Department of War to designate Anthropic a Supply Chain Risk to National Security," Hegseth wrote. The designation comes after weeks of negotiations between the Pentagon and Anthropic over the use of its AI models by the U.S. military. In a post published this week, the company argued that its contracts should not facilitate mass domestic surveillance or the development of autonomous weapons, citing reasons that the technology isn't capable enough to support them safely and reliably. "We support the use of AI for lawful foreign intelligence and counterintelligence missions," Anthropic noted. "But using these systems for mass domestic surveillance is incompatible with democratic values. AI-driven mass surveillance presents serious, novel risks to our fundamental liberties." The company also called out the U.S. Department of War's (DoW) position that it will only work with AI companies that allow "any lawful use" of the technology, while removing any safeguards that may exist, as part of efforts to build an "AI-first" warfighting force and bolster national security. "Diversity, Equity, and Inclusion and social ideology have no place in the DoW, so we must not employ AI models which incorporate ideological 'tuning' that interferes with their ability to provide objectively truthful responses to user prompts," a memorandum issued by the Pentagon last month reads. "The Department must also utilize models free from usage policy constraints that may limit lawful military applications." Responding to the designation, Anthropic described it as "legally unsound" and said it would set a dangerous precedent for any American company that negotiates with the government. It also noted that a supply chain risk designation under 10 USC 3252 can only extend to the use of Claude as part of DoW contracts, and that it cannot affect the use of Claude to serve other customers. Sean Parnell, the Pentagon's chief spokesperson, said in a Thursday X post that the department has no interest in conducting mass domestic surveillance or deploying autonomous weapons without human involvement, describing the narrative as "fake." "Here's what we're asking: Allow the Pentagon to use Anthropic's model for all lawful purposes," Parnell said. "This is a simple, common-sense request that will prevent Anthropic from jeopardizing critical military operations and potentially putting our warfighters at risk. We will not let ANY company dictate the terms regarding how we make operational decisions." The ongoing stalemate has also polarized the tech industry. Hundreds of employees at Google and OpenAI have signed an open letter urging their companies to stand with Anthropic in its clash with the Pentagon over military applications for AI tools like Claude. xAI CEO Elon Musk sided with the Trump administration on Friday, saying "Anthropic hates Western Civilization." The standoff between Anthropic and the U.S. government comes as OpenAI CEO Sam Altman said OpenAI reached an agreement with the U.S. Department of Defense (DoD) to deploy its models in their classified network. It also asked DoD to extend those terms to all AI companies. "AI safety and wide distribution of benefits are the core of our mission. Two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems," Altman said in a post on X. "The DoW agrees with these principles, reflects them in law and policy, and we put them into our agreement." OpenAI Says its Agreement Adheres to Three Red Lines The public spat between Anthropic and the U.S. government has led to its Claude chatbot jumping to the top slot on Apple's chart of top U.S. free apps, even as OpenAI CEO Sam Altman said the company's designation as a supply chain risk sets an "extremely scary precedent." The AI company also shared more details on its agreement with the Pentagon for deploying advanced AI systems in classified environments, adding "we think our agreement has more guardrails than any previous agreement for classified AI deployments, including Anthropic's." It said the work with the DoW is guided by three red lines. This includes no use of OpenAI technology for mass domestic surveillance, to direct autonomous weapons systems, and for high-stakes automated decisions, such as social credit systems. "In our agreement, we protect our red lines through a more expansive, multi-layered approach," the company said in a statement. "We retain full discretion over our safety stack, we deploy via cloud, cleared OpenAI personnel are in the loop, and we have strong contractual protections." Altman also said the company will consider committing to publishing every change to the red lines in the future, along with a public explanation and a mandatory notice period before it takes effect. In a LinkedIn post, OpenAI's head of national security partnerships Katrina Mulligan argued that its contract limits the deployment to cloud API, gives it control over the models and safety stack deployed, and human AI experts are in the loop to make any modifications if its "models aren't refusing queries they should, or there's more operational risk than we expected." "Autonomous systems require inference at the edge," Mulligan said. "By limiting our deployment to cloud API, we can ensure that our models cannot be integrated directly into weapons systems, sensors, or other operational hardware." OpenAI's deal also coincides with a report from The Wall Street Journal, which revealed that the U.S. conducted a major air attack on Iran with the help of Anthropic's AI tools despite disagreements over its use. More Details About OpenAI's Deal Emerge In a new report, The Verge said OpenAI's deal with the Pentagon is "much softer" than Anthropic's, adding "OpenAI agreed to follow laws that have allowed for mass surveillance in the past." A Trump administration official confirmed that the agreement "flows from the touchstone of 'all lawful use,'" while including certain mutually agreed-upon safety mechanisms. OpenAI has emphasized that "any handling of private information will comply with the Fourth Amendment, the National Security Act of 1947, and the Foreign Intelligence and Surveillance Act of 1978, Executive Order 12333, and applicable DoD directives requiring a defined foreign intelligence purpose." The company also noted that its agreement "does not permit uses of our models for unconstrained monitoring of U.S. persons' private information, and all intelligence activities must comply with existing U.S. law." However, Techdirt's Mike Masnick pointed out that EO 12333 is "one of the largest loopholes for surveilling Americans' communications that the intelligence community possesses," and that OpenAI's red lines are defined by the U.S. government's "carefully constructed legal definitions" that have been refined and stretched to facilitate domestic surveillance. The backlash triggered by concerns that the deal could enable mass surveillance of Americans has led OpenAI and the Pentagon to "strengthen their recently agreed contract," Axios reported, citing sources familiar with the pact. Specifically, the language used in the contract states that the "AI system shall not be intentionally used for domestic surveillance of U.S. persons and nationals." This prohibition extends to analyzing commercially available data obtained from data brokers. As of writing, the Pentagon has not sent a formal notice to Anthropic designating it a supply chain risk. "It's critical to protect the civil liberties of Americans, and there was so much focus on this, that we wanted to make this point especially clear, including around commercially acquired information," Altman said on X. (The story was updated after publication with the latest developments.)