Tag: supply-chain
-
Salesloft Breached via GitHub Account Compromise
The breach kickstarted a massive supply chain attack that led to the compromise of hundreds of Salesforce instances through stolen OAuth tokens. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/salesloft-breached-github-account-compromise
-
Dev snared in crypto phishing net, 18 npm packages compromised
Popular npm packages debug, chalk, and others hijacked in massive supply chain attack First seen on theregister.com Jump to article: www.theregister.com/2025/09/08/dev_falls_for_phishing_email/
-
Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack
A new supply chain attack on GitHub, dubbed ‘GhostAction,’ has compromised 3,325 secrets, including PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-steal-3-325-secrets-in-ghostaction-github-supply-chain-attack/
-
Salesloft platform integration restored after probe reveals monthslong GitHub account compromise
An investigation by Mandiant found the attack began months ago, leading to a major supply chain attack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
-
Salesloft platform integration restored after probe reveals monthslong GitHub account compromise
An investigation by Mandiant found the attack began months ago, leading to a major supply chain attack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
-
Salesloft platform integration restored after probe reveals monthslong GitHub account compromise
An investigation by Mandiant found the attack began months ago, leading to a major supply chain attack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
-
Salesloft Drift integration restored after probe reveals monthslong GitHub account compromise
An investigation by Mandiant found the attack began months ago, leading to a major supply chain attack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
-
Salesloft Drift integration restored after probe reveals monthslong GitHub account compromise
An investigation by Mandiant found the attack began months ago, leading to a major supply chain attack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
-
Salesloft Drift integration restored after probe reveals monthslong GitHub account compromise
An investigation by Mandiant found the attack began months ago, leading to a major supply chain attack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
-
Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack
In what is being called the largest supply chain attack in history, attackers have injected malware into NPM packages with over 2.6 billion weekly downloads after compromising maintainers’ accounts in a phishing attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/
-
GitHub Account Compromise Led to Salesloft Drift Breach Affecting 22 Companies
Salesloft has revealed that the data breach linked to its Drift application started with the compromise of its GitHub account.Google-owned Mandiant, which began an investigation into the incident, said the threat actor, tracked as UNC6395, accessed the Salesloft GitHub account from March through June 2025. So far, 22 companies have confirmed they were impacted by…
-
Salesloft Drift integration restored after probe reveals months-long GitHub account compromise
An investigation by Mandiant found the attack began months ago, leading to a major supply chain attack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
-
Salesloft Drift integration restored after probe reveals months-long GitHub account compromise
An investigation by Mandiant found the attack began months ago, leading to a major supply chain attack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
-
Wealthsimple Confirms Data Breach After Supply Chain Attack
Wealthsimple confirmed a third-party vendor data breach affecting roughly 30,000 customers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/wealthsimple-confirms-data-breach/
-
Canadian investment platform Wealthsimple disclosed a data breach
Wealthsimple reported a data breach affecting some customers due to a supply chain attack via a third-party software package. Canadian investment platform Wealthsimple disclosed a data breach that impacted some customers. The company discovered the security breach on August 30, which stemmed from a supply chain attack via a trusted third-party software package. >>On August 30th,…
-
Canadian investment platform Wealthsimple disclosed a data breach
Wealthsimple reported a data breach affecting some customers due to a supply chain attack via a third-party software package. Canadian investment platform Wealthsimple disclosed a data breach that impacted some customers. The company discovered the security breach on August 30, which stemmed from a supply chain attack via a trusted third-party software package. >>On August 30th,…
-
GhostAction campaign steals 3325 secrets in GitHub supply chain attack
Tags: ai, attack, control, credentials, data-breach, detection, exploit, github, malicious, network, pypi, risk, supply-chain, threatThreat contained within days: GitGuardian’s security team responded quickly after detection, and the FastUUID package was set to read-only by PyPI administrators within minutes. The malicious commit was reverted shortly afterward. GitGuardian notified maintainers of the affected repositories, successfully contacting 573 projects, while also alerting GitHub, npm, and PyPI security teams to monitor for abuse.Although…
-
GhostAction campaign steals 3325 secrets in GitHub supply chain attack
Tags: ai, attack, control, credentials, data-breach, detection, exploit, github, malicious, network, pypi, risk, supply-chain, threatThreat contained within days: GitGuardian’s security team responded quickly after detection, and the FastUUID package was set to read-only by PyPI administrators within minutes. The malicious commit was reverted shortly afterward. GitGuardian notified maintainers of the affected repositories, successfully contacting 573 projects, while also alerting GitHub, npm, and PyPI security teams to monitor for abuse.Although…
-
Salesloft Drift data breach: Investigation reveals how attackers got in
The attack that resulted in the Salesloft Drift data breach started with the compromise of the company’s GitHub account, Salesloft confirmed this weekend. Supply chain … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/08/salesloft-drift-data-breach-investigation-results/
-
Salesloft Drift data breach: Investigation reveals how attackers got in
The attack that resulted in the Salesloft Drift data breach started with the compromise of the company’s GitHub account, Salesloft confirmed this weekend. Supply chain … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/08/salesloft-drift-data-breach-investigation-results/
-
The Cyberthreats No One Talks About but Everyone Faces
Beyond ransomware and phishing, hidden cyberthreats are rising, from AI-driven deepfakes and scams to shadow IT, and supply chain attacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/the-cyberthreats-no-one-talks-about-but-everyone-faces/
-
The Cyberthreats No One Talks About but Everyone Faces
Beyond ransomware and phishing, hidden cyberthreats are rising, from AI-driven deepfakes and scams to shadow IT, and supply chain attacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/the-cyberthreats-no-one-talks-about-but-everyone-faces/
-
GhostAction Supply Chain Attack Compromises 3000+ Secrets
Security researchers have discovered a new malicious campaign impacting hundreds of GitHub users First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ghostaction-supply-chain-3000/
-
Salesforce Under Fire: The Salesloft Drift Supply-Chain Breach
In this episode, we discuss a recent significant cyber attack where Palo Alto Networks experienced a data breach through their Salesforce environment due to a compromised SalesLoft drift integration. Throughout the discussion, we highlight why Salesforce, a crucial CRM platform for many businesses, is becoming a prime target for supply chain attackers. The hosts discuss……
-
The importance of reviewing AI data centers’ policies
Tags: ai, attack, backdoor, corporate, cybersecurity, data, government, Hardware, jobs, monitoring, risk, side-channel, supply-chain, threat, tool, vulnerabilityWhat cybersecurity leaders need to consider: Given these expanded threats, cybersecurity leaders and decision makers must closely scrutinize whether their AI data center operators are implementing corporate policies that require technical measures to secure AI data centers across all layers of security, including hardware, data, and geopolitical. Examples of such policies include: closely inspecting hardware…
-
AI-powered malware hit 2,180 GitHub accounts in “s1ngularity” attack
Investigations into the Nx “s1ngularity” NPM supply chain attack have unveiled a massive fallout, with thousands of account tokens and repository secrets leaked. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/
-
GhostAction Attack Steals 3,325 Secrets from GitHub Projects
GhostAction supply chain attack hit 817 GitHub repositories, stealing 3,325 secrets including npm, PyPI, and DockerHub tokens. First seen on hackread.com Jump to article: hackread.com/ghostaction-attack-steals-github-projects-secrets/
-
ISMG Editors: The Pentagon, Microsoft and Chinese Workers
Also: Software Supply Chain Risks, Cato’s AI Security Buy. In this week’s update, four ISMG editors discussed the Pentagon’s review of Microsoft’s use of Chinese nationals on U.S. military cloud systems, renewed concerns over software supply chain risks and Cato Networks’ first-ever acquisition to boost AI security. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ismg-editors-pentagon-microsoft-chinese-workers-a-29380
-
The GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflows
On September 5, 2025, GitGuardian discovered GhostAction, a massive supply chain attack affecting 327 GitHub users across 817 repositories. Attackers injected malicious workflows that exfiltrated 3,325 secrets, including PyPI, npm, and DockerHub tokens via HTTP POST requests to a remote endpoint. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/the-ghostaction-campaign-3325-secrets-stolen-through-compromised-github-workflows/
-
Blast Radius of Salesloft Drift Attacks Remains Uncertain
Many high-profile Salesloft Drift customers have disclosed data breaches as a result of a recent supply-chain attack, but the extent and severity of this campaign are unclear. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/salesloft-drift-attacks-blast-radius-uncertain