Tag: supply chain attack
112 articles
China-Linked GopherWhisper Targets Mongolian Government Systems with Go Backdoors
A China-linked cyber group, dubbed GopherWhisper, has been targeting Mongolian government systems with a suite of Go-based backdoors, infecting at least 12 systems and potentially dozens more. The attackers used clever tactics, routing command-and-control traffic through compromised Discord and Slack servers.
npm Ecosystem Targets New Supply-Chain Attack to Steal Auth Tokens
Researchers have uncovered a sneaky supply-chain worm that can hijack auth tokens and spread malware through the npm ecosystem, putting countless packages at risk. This stealthy threat can inject itself into every package it can publish, creating a ripple effect of compromised code.
Adaptavist Group Breach Sparks Imposter Email Scams
When security breaches strike, even the most trusted names can be compromised - and The Adaptavist Group is the latest example, with hackers using stolen credentials to gain access and now sending fake emails that could put your data at risk.
Ransomware Breach Exposes 337,000 CRMC Patients' Sensitive Data
A ransomware attack on a Tennessee hospital system has compromised the sensitive data of over 337,000 patients, leaving many to wonder who will watch over their personal records. In July 2025, Cookeville Medical Center (CRMC) reported a devastating breach tied to the notorious Rhysida group.
Malicious Ledger Live App Drains $9.5M in Crypto from Apple Users
A malicious Ledger Live app on Apple's App Store siphoned off a staggering $9.5 million in cryptocurrency from 50 unsuspecting users in just a few days. This shocking incident raises serious concerns about app security and the safety of our digital assets.
CPUID Website Compromised, Serves Malware via HWMonitor Downloads
For six hours, unsuspecting visitors to the CPUID website were put at risk of having their passwords stolen when malicious malware was served in place of the HWMonitor tool they were trying to download. This alarming security breach highlights the vulnerability even trusted sites can have, leaving users to wonder if their sensitive information is safe.
CPUID Compromised in Supply Chain Attack
A recent supply chain attack on the CPUID project has raised alarming questions about trust in software downloads, after hackers manipulated the official website to serve malware-infected versions of popular tools like CPU-Z and HWMonitor. Can users, defenders, and policymakers be certain that their software sources are safe?
TeamPCP Infiltrates Security Infrastructure with Multi-Stage Supply Chain Attack
When security tools meant to safeguard networks become the entry point for attacks, trust is shattered - and that's exactly what's happening with TeamPCP's multi-stage supply chain attacks on security infrastructure. This sinister tactic lets threat actors turn protectors into launchpads for wider compromise.
Unit 42 Uncovers Axios Supply Chain Attack's Far-Reaching Consequences
When a trusted software pathway is compromised, the consequences can be far-reaching - as Unit 42's recent analysis of the Axios supply chain attack starkly reveals, threatening digital trust and resilience. The team's detailed examination exposes the attack's full chain, from initial dropper to forensic cleanup.
Third-Party Risk Exposes Hidden Weaknesses in Client Security Posture
The next big security breach hitting your clients likely won't come from within their own walls, but from a blind spot they never suspected: their trusted third-party relationships with vendors, SaaS tools, and subcontractors. Most organizations are woefully underprepared for this expanding attack surface.
Mercor Hit in Widespread LiteLLM Supply-Chain Attack
Thousands of companies, including AI hiring startup Mercor, have been hit by a widespread LiteLLM supply-chain attack, marking the first publicly disclosed downstream casualty of a software supply-chain intrusion. This incident raises a critical question: how can organizations trust their tech toolchains when the chain itself can be compromised?
Axios Library Compromised in North Korea-Linked Supply Chain Attack
A widely-used JavaScript library, Axios, has been compromised in a supply-chain attack linked to North Korea, allowing attackers to secretly inject malicious code into millions of applications and systems. This sneaky move has sent shockwaves through the open-source software community, highlighting the vulnerability of even the most trusted code.
Hackers Compromise Axios Package to Spread RAT Malware
A recent breach of the popular Axios npm package has exposed a critical supply chain vulnerability: hackers hijacked a maintainer account to spread remote access trojans, putting thousands of applications and developers at risk.
Cisco Hit by Alarming Code Heist After Trivy Breach
A shocking code heist has hit Cisco, with hackers making off with sensitive source code after infiltrating the company's internal development environment through a Trivy supply-chain attack. This brazen breach raises urgent questions about the hidden vulnerabilities lurking in today's interconnected development ecosystems.
Malware Alert: Critical Axios NPM Hack Spreads Devastating Cross-Platform Threats
A critical security breach has hit Axios, a widely-used JavaScript library with over 100 million weekly downloads, leaving developers and users vulnerable to devastating cross-platform threats. This shocking incident raises a crucial question: can even the most trusted software sources be considered secure?
Axios Backdoor: Critical npm Supply Chain Attack Unleashes Devastating RAT Malware
A single compromised account has triggered a critical supply chain attack on Axios, a widely-used JavaScript library, unleashing devastating RAT malware and putting millions of developers worldwide at risk. This shocking breach highlights the urgent need for more stringent security measures to protect our global software ecosystem.
Axios Hit by Critical Supply Chain Attack
A critical supply chain attack has hit Axios, a popular HTTP client, compromising the integrity of its npm package and raising fresh concerns about the security of our digital infrastructure. Malicious versions of the Axios package were published, injecting a fake dependency that put users at risk.
Malicious PyPI Packages Spread Devastating Malware
Malicious actors have struck again, this time infiltrating the Python Package Index (PyPI) with tainted versions of popular packages Telnyx and LiteLLM, putting developers' sensitive credentials at risk. Can we trust the software supply chain when even seemingly secure systems can be breached?
Crypto Scam ShieldGuard Dismantled in Stunning Malware Bust
The ShieldGuard Chrome extension, sold as a crypto safeguard, quietly stole private keys and drained wallets — a stark reminder that a browser helper can easily become a thief. Find out how investigators tore it down and what steps to take now to protect your assets.
North Korea’s APT37 Exclusive: Dangerous Tool Hits Air-Gap
Think the most isolated machines are untouchable? North Korea’s APT37 has broadened its toolkit — combining believable lures with new utilities that can defeat air‑gap protections and put highly sensitive systems at fresh risk.
eScan Antivirus Exclusive: Servers Breached, Severe Malware
Imagine your antivirus becoming the delivery system for malware — that’s what happened when eScan antivirus update servers pushed persistent downloaders and staged payloads to thousands of systems. The breach shows how trusted update channels and elevated security privileges can turn supply‑chain risk into a widespread disaster.
Trust Wallet Chrome Extension Breach: Critical $7M Loss
If you use the Trust Wallet Chrome extension, update it immediately—version 2.68 was compromised and has already led to roughly $7 million in losses across about a million users. Take a moment to review connected sites, revoke suspicious approvals, and secure your seed phrase.
Coupang Breach: Stunning Damage Hits 34M, Leaders React
Coupang breach jolted roughly 34 million customers after attackers used vishing and compromised vendor channels to steal—and then extort—sensitive data; here’s what went wrong and what customers and companies need to do next.
Logitech Breach Prompts Stunning Critical Security Response
The confirmed Logitech breach is a wake‑up call for anyone with vendor integrations. Security leaders recommend treating third‑party access as an attack vector — audit entitlements, tighten tokens and OAuth scopes, and boost detection to stop downstream damage.