Researchers at Socket found 18 malicious npm packages that deliver a cross-platform remote access trojan to users of Alibaba developer tools, splitting the attack across many packages so each looks harmless on its own. Ten lure packages with no real function depend on a bridge package, which pulls in loaders that fetch a rule-engine configuration from GitHub and use it to run OS-specific payloads from a server disguised as Alibaba infrastructure. On Windows it even replaces a legitimate Alibaba security app with a trojanized copy. The final trojan can steal data, run commands, and move laterally, and the campaign stayed hidden for about three months.
Resecurity reports that the INC ransomware operation has become the dominant group exploiting two SonicWall SMA1000 VPN appliance flaws, accelerating its attacks since early August. The pair, CVE-2026-15409 and CVE-2026-15410, were exploited as zero-days before SonicWall patched them in mid-July, and can be chained to gain root on the appliance and extract credentials, session databases, and one-time-password data. Many appliances remain unpatched or already compromised, leaving footholds attackers can reuse. Victims listed recently span private and government organizations across several countries, and some reported follow-up emails and phone calls from people claiming to help with the ransomware.
Attackers compromised a widely used tracking script from advertising firm Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. The malicious code was appended in obfuscated form to Adform's trackpoint-async.js library, served from the company's own infrastructure, so any site loading it ran the altered script in visitors' browsers. It swapped Bitcoin, Ethereum, and Tron addresses both in the clipboard and in form fields, redirecting transfers to the attacker. Adform detected and removed the code on July 27 and says it did not install software or persist after a page closed, but cached copies may linger. It has not said how many page loads were affected.
The Arch Linux project temporarily disabled adoption of packages in its user repository, the AUR, after a wave of malicious takeovers of existing packages. Attackers seized packages through compromised maintainer accounts or by adopting orphaned ones, then shipped a Rust-based infostealer that grabs browser credentials, cryptocurrency wallets, password manager data, cloud and developer secrets, AI service API keys, and SSH keys. It also opens remote command execution over an encrypted Tor channel and spreads to other machines using stolen SSH keys. A researcher tracking the campaign claims more than 200 packages were hit, including some popular ones, though that list is not independently confirmed.
Palo Alto Networks Unit 42 detailed a Chinese-speaking attacker who used the DeepSeek model as the reasoning engine inside an open-source agent called Hermes to attack exposed servers with little human input. Taking instructions over Telegram and using an internet asset search engine, the agent ran in a mode that executes commands without asking permission: from a single task, it downloaded a public exploit, enumerated vulnerable Langflow and n8n instances, judged targets by value, and attempted exploitation on its own. The autonomous attempts failed, blocked by authentication and configuration, though the operator succeeded manually elsewhere. The operation was exposed when the agent accidentally served its own working directory over the web.
A researcher disclosed a prompt-injection technique that turns Microsoft 365 Copilot for Word into a carrier for self-spreading instructions. Malicious commands hidden as tiny white-on-white text in a document are invisible to a reader but read in full by Copilot when the file enters its context during a drafting or editing task. Copilot then follows them, in one example silently altering financial figures in a report, and copies the same hidden instructions into the new document, which becomes a fresh carrier for the next person who uses it. It does not spread on its own, but Microsoft's mitigations over 144 days blocked specific wordings without fixing the underlying class.
Amazon's threat intelligence team linked several major npm supply chain attacks to a North Korean group tracked as Sapphire Sleet, also known as BlueNoroff. The group compromised the small typo-crypto package in March 2025 as a test, then hijacked the hugely popular debug and chalk packages in September 2025, and axios in March 2026. The debug and chalk incident, which pushed a wallet-draining script into packages with billions of weekly downloads, reached roughly one in ten cloud environments within two hours. The attackers gained access by phishing package maintainers through lookalike npm domains, then published malicious versions that auto-installing projects pulled in.
Sophos detailed a campaign, tracked as STAC4749, in which attackers impersonate IT help desk staff over Microsoft Teams to talk employees into granting remote access, then deploy Chaos ransomware. Using external Teams accounts, the operators start chats and voice calls claiming to fix an urgent problem, persuade the target to open a remote support session, and run PowerShell to pull down a modular toolkit for persistence and lateral movement. Between February and June 2026 they hit dozens of North American organizations, about 95 percent in the US and Canada, across services, manufacturing, energy, and construction. In one case they went from first contact to encrypting files in under seventeen hours.
Attackers published malicious versions of the @joyfill/components and @joyfill/layouts npm packages that run a remote access trojan as soon as the package is imported, not merely installed. Because the payload executes at import time, defenses that block install scripts, such as installing with scripts disabled, do not stop it. The malicious code sat only in the published tarballs with no matching source change, pointing to a registry or publishing pipeline compromise. Once loaded, it profiles the host, opens a remote-control channel, and can run shell commands, upload files, read the clipboard, and tamper with developer tools, using blockchain networks to resolve its next payload for resilience.
New research shows that application security scanners embedded in the software pipeline can themselves be attacked, because analyzing a repository is not always a read-only action. Many scanners execute code or process files in ways that can be forced to run attacker content when it is handled without isolation. For example, a tool that scans cloud configuration files against a folder of custom rules can be fed a rule that is actually a malicious program, which the scanner runs when it loads it. Since scanners often hold broad access to source, secrets, and build systems, a compromised one is a strong pivot point into the wider environment.
TrustStrike Labs