Tag: attack

Checkmarx Supply Chain Attack Exploits Docker Images and CI/CD Pipelines

Apr 23, 2026 9:39 PM

Tags: attack, credentials, docker, exploit, malicious, supply-chain

A Checkmarx supply chain attack used malicious Docker images and extensions to steal credentials and spread through CI/CD pipelines. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/checkmarx-supply-chain-attack-exploits-docker-images-and-ci-cd-pipelines/
Trigona ransomware attacks use custom exfiltration tool to steal data

Apr 23, 2026 9:39 PM

Tags: attack, data, ransomware, tool

Recently observed Trigona ransomware attacks are using a custom, command-line tool to steal data from compromised environments faster and more efficiently. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trigona-ransomware-attacks-use-custom-exfiltration-tool-to-steal-data/
Mythos Is a Wake-Up Call for DDoS Defense

Apr 23, 2026 8:39 PM

Tags: ai, attack, ddos, defense, finance, infrastructure, service, software

Will Anthropic’s Mythos, with its AI-powered identification of software and infrastructure weaknesses, upset the financial services industry by means of new, AI-developed attacks? Major bank leaders were called to an urgent meeting by Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell, over concerns that the latest AI model released by Anthropic (the developer..…
Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
The Guardian view on Anthropic’s Claude Mythos: when AI finds every flaw, who controls the internet? | Editorial

Apr 23, 2026 8:39 PM

Tags: access, ai, attack, business, computer, control, crime, cyber, cybersecurity, email, exploit, finance, flaw, hacker, Internet, risk, threat, vulnerability

Tech can scale cyber-attacks and defences alike, raising questions about private power, public risk and the future of a shared internetAnthropic announced its latest AI model, <a href=”https://www.theguardian.com/technology/2026/apr/08/anthropic-ai-cybersecurity-software”>Claude Mythos, this month but said it would not be released publicly, because it turns computers into crime scenes. The company claimed that it could find previously unknown…
Iran-nexus threat groups refine attacks against critical infrastructure

Apr 23, 2026 7:39 PM

Tags: attack, group, infrastructure, iran, threat

State-sponsored and hacktivist groups have shown greater determination to damage or disable energy, water and other key sectors. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/iran-nexus-threat-groups-refine-attacks-against-critical-infrastructure/818299/
What We Mean by Procedures (And Why Precision Matters)

Apr 23, 2026 5:39 PM

Tags: attack, detection, intelligence, strategy, threat

<div cla Why Terminology Confusion Still Undermines Modern Defense Cybersecurity discussions are filled with familiar language. Security teams talk about the latest threats and threat landscape, attack techniques and behavior, adversary tradecraft, and detection coverage. These terms appear constantly in threat intelligence reports, product documentation, and security strategy conversations. First seen on securityboulevard.com Jump to…
What We Mean by Procedures (And Why Precision Matters)

Apr 23, 2026 5:39 PM

Tags: attack, detection, intelligence, strategy, threat

<div cla Why Terminology Confusion Still Undermines Modern Defense Cybersecurity discussions are filled with familiar language. Security teams talk about the latest threats and threat landscape, attack techniques and behavior, adversary tradecraft, and detection coverage. These terms appear constantly in threat intelligence reports, product documentation, and security strategy conversations. First seen on securityboulevard.com Jump to…
With AI’s help, North Korean hackers stumbled into a near-undetectable attack

Apr 23, 2026 5:39 PM

Tags: ai, attack, exploit, hacker, hacking, malware, north-korea, phishing, social-engineering

For many years, state-sponsored hacking was defined by human expertise in finding security holes, writing malware and exploits, pulling off social engineering and phishing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/23/hexagonalrodent-north-korean-hackers-targeting-developers/
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

Apr 23, 2026 5:39 PM

Tags: application-security, attack, malicious, supply-chain

Bitwarden CLI has been compromised as part of the newly discovered and ongoing Checkmarx supply chain campaign, according to new findings from Socket.”The affected package version appears to be @bitwarden/cli@2026.4.0, and the malicious code was published in ‘bw1.js,’ a file included in the package contents,” the application security company said.”The attack appears to have leveraged…
Threat on the Horizon AI and Cybersecurity

Apr 23, 2026 4:39 PM

Tags: ai, attack, ceo, cybersecurity, threat

AI is changing cybersecurity on both sides of the equation. It is accelerating how attacks are executed while also strengthening how organizations detect and respond. In this month’s blog, SilverSky’s CEO shares how the organization is approaching AI-driven threats and what regulated organizations should be doing now to stay ahead. First seen on securityboulevard.com Jump…
Offer customers passkeys by default, UK’s NCSC tells enterprises

Apr 23, 2026 4:39 PM

Tags: attack, authentication, credentials, cyber, identity, login, mfa, passkey, password, phishing, risk, service, strategy, theft

How passkeys change the attack model: The NCSC added that passkeys reduce risk by removing reliance on shared secrets and binding authentication to the legitimate service.According to the agency, this prevents credential reuse and relay attacks, as authentication cannot be intercepted and reused by an attacker.Passkeys use cryptographic key pairs stored on a user’s device,…
UK’s NCSC calls passkeys the default, says passwords are no longer fit for the purpose

Apr 23, 2026 3:39 PM

Tags: attack, authentication, credentials, cyber, identity, login, mfa, passkey, password, phishing, risk, service, strategy, theft

How passkeys change the attack model: The NCSC added that passkeys reduce risk by removing reliance on shared secrets and binding authentication to the legitimate service.According to the agency, this prevents credential reuse and relay attacks, as authentication cannot be intercepted and reused by an attacker.Passkeys use cryptographic key pairs stored on a user’s device,…
Africa Relinquishes Cyberattack Lead to Latin America, For Now

Apr 23, 2026 3:39 PM

Tags: attack, cyberattack, usa

The volume of cyberattacks targeting Africa declined in the past year, with weekly attacks down 22%, as attackers seemingly shifted their focus to other regions. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/african-organizations-see-easing-of-cyberattacks
New GopherWhisper APT group abuses Outlook, Slack, Discord for comms

Apr 23, 2026 2:39 PM

Tags: apt, attack, government, group, microsoft, service, threat

A previously undocumented state-backed threat actor named GopherWhisper is using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord in attacks against government entities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/
New GopherWhisper APT group abuses Outlook, Slack, Discord for comms

Apr 23, 2026 2:39 PM

Tags: apt, attack, government, group, microsoft, service, threat

A previously undocumented state-backed threat actor named GopherWhisper is using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord in attacks against government entities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/
No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours

Apr 23, 2026 2:39 PM

Tags: api, attack, cloud, credentials, docker, pypi, supply-chain

Three supply chain attacks hit npm, PyPI, and Docker Hub between April 2123, 2026. All three targeted secrets: API keys, cloud credentials, SSH keys, and tokens from developer environments and CI/CD pipelines. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/no-off-season-three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours/
Hackers Use Hidden Website Instructions in New Attacks on AI Assistants

Apr 23, 2026 1:39 PM

Tags: ai, attack, cybersecurity, exploit, github, hacker, injection

Cybersecurity researchers at Forcepoint uncover new indirect prompt injection attacks that use hidden website code to exploit AI assistants like GitHub Copilot. First seen on hackread.com Jump to article: hackread.com/hackers-hidden-site-instruction-attack-ai-assistants/
Cyber-Attacks Surge 63% Annually in Education Sector

Apr 23, 2026 1:39 PM

Tags: attack, cyber

Quorum Cyber report finds higher and further education institutions experienced 63% increase in attacks over a year First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cyberattacks-surge-63-annually/
‘Zealot’ Shows What AI’s Capable of in Staged Cloud Attack

Apr 23, 2026 12:39 PM

Tags: ai, attack, cloud

The proof of concept revealed AI-based attacks unfold too fast for human defenders to respond, and that AI evinced more autonomous behavior than expected. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/zealot-shows-ai-execute-full-cloud-attacks
Researchers Uncover 10 InWild Prompt Injection Payloads Targeting AI Agents

Apr 23, 2026 12:39 PM

Tags: ai, attack, injection

Forcepoint has found 10 new indirect prompt injection attacks targeting AI agents First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/researchers-10-wild-indirect/
Attackers Exploit LMDeploy Flaw in the Wild Within 12 Hours of Advisory

Apr 23, 2026 11:39 AM

Tags: advisory, attack, cyber, exploit, flaw, github, open-source, vulnerability

A critical Server-Side Request Forgery (SSRF) vulnerability in LMDeploy’s vision-language module was exploited in active attacks just 12 hours and 31 minutes after its public disclosure, with no proof-of-concept code required. On April 21, 2026, GitHub published security advisory GHSA-6w67-hwm5-92mq, later assigned CVE-2026-33626, a high-severity SSRF flaw (CVSS 7.5) in LMDeploy, an open-source toolkit developed by Shanghai…
Xinference PyPI Breach Exposes Developers to Cloud Credential Theft

Apr 23, 2026 10:39 AM

Tags: attack, breach, cloud, credentials, cyber, data, malicious, pypi, software, supply-chain, theft, threat, tool

A severe supply chain attack has compromised the popular Python package Xinference, exposing developers to massive data theft. Threat actors uploaded malicious versions of the tool to the Python Package Index (PyPI), embedding a heavily obfuscated infostealer into the code. Xinference has over 600,000 total downloads, making this a significant security event for the software…
Checkmarx KICS Docker Repo Hijacked in Malicious Code Injection Attack

Apr 23, 2026 9:39 AM

Tags: attack, cloud, credentials, cyber, docker, infrastructure, injection, malicious, software, supply-chain, threat

A massive software supply chain attack has targeted the official Checkmarx KICS (Keeping Infrastructure as Code Secure) Docker Hub repository. Discovered on April 22, 2026, by Docker and Socket, the compromise involves trojanized Docker images and malicious VS Code extensions designed to harvest and exfiltrate highly sensitive developer credentials and cloud infrastructure secrets. Threat actors…
CNAPP ein Kaufratgeber

Apr 23, 2026 6:39 AM

Tags: access, ai, application-security, attack, authentication, cloud, container, detection, edr, encryption, framework, group, ibm, infrastructure, intelligence, kubernetes, linux, ml, monitoring, network, open-source, risk-management, saas, soar, software, supply-chain, threat, tool, vmware

Cloud Security bleibt ein diffiziles Thema und die Tools, mit denen sie sich gewährleisten lässt, werden zunehmend komplexer und schwieriger zu durchschauen auch dank der ungebrochenen Liebe der Branche zu Akronymen. Mit CNAPP kommt nun ein weiteres hinzu. Die Abkürzung steht für Cloud-Native Application Protection Platform und kombiniert die Funktionen von vier separaten Cloud-Security-Werkzeugen: Cloud…
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener

Apr 23, 2026 5:39 AM

Tags: access, api, attack, backdoor, china, cloud, control, data, detection, github, infection, intelligence, korea, login, malicious, malware, military, monitoring, network, open-source, service, tactics, threat, tool, windows

IntroductionOn March 12, 2026, Zscaler ThreatLabz discovered a malicious ZIP archive containing military-themed document lures targeting Chinese-speaking individuals. Our analysis of this sample uncovered a campaign leveraging a multi-stage attack chain where a trojanized SumatraPDF reader deploys an AdaptixC2 Beacon agent, ultimately leading to the download and abuse of Visual Studio (VS) Code tunnels for…
Claude Mythos signals a new era in AI-driven security, finding 271 flaws in Firefox

Apr 23, 2026 5:39 AM

Tags: access, ai, attack, browser, ciso, control, cyber, data-breach, exploit, flaw, hacking, incident response, infrastructure, intelligence, monitoring, openai, software, threat, tool, unauthorized, vulnerability

Defenders now able to win ‘decisively’?: Gaps between human-discoverable and AI-discoverable bugs favor attackers, who can afford to concentrate months of human effort to find just one bug they can exploit, Holley noted. Closing this gap with AI can help defenders erode that long-term advantage.The industry has largely been fighting security “to a draw,” he…
Malicious pgserve, automagik developer tools found in npm registry

Apr 23, 2026 5:39 AM

Tags: access, attack, breach, cloud, control, corporate, credentials, crypto, data, firewall, github, infrastructure, least-privilege, malicious, malware, network, open-source, password, radius, risk, service, software, tactics, theft, threat, tool, worm

Advice to victimized developers: Developers who have downloaded the malicious versions of pgserver and automagik need to act fast, says Tanya Janca, head of Canadian secure coding consultancy SheHacksPurple.”Rotate every credential you can think of, right now, before you do anything else,” she said. “Then harden your CI/CD network egress controls so your build runners…