Collecting Cyber-News from over 60 sources

Tag: worm

Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
The Butlerian Jihad: Compromised Bitwarden CLI Deploys npm Worm, Poisons AI Assistants, and Dumps GitHub Secrets

Apr 23, 2026 8:39 PM

Tags: ai, github, supply-chain, worm

Mend.io tracks TeamPCP’s latest supply chain attack. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/the-butlerian-jihad-compromised-bitwarden-cli-deploys-npm-worm-poisons-ai-assistants-and-dumps-github-secrets/
Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
Malicious pgserve, automagik developer tools found in npm registry

Apr 23, 2026 5:39 AM

Tags: access, attack, breach, cloud, control, corporate, credentials, crypto, data, firewall, github, infrastructure, least-privilege, malicious, malware, network, open-source, password, radius, risk, service, software, tactics, theft, threat, tool, worm

Advice to victimized developers: Developers who have downloaded the malicious versions of pgserver and automagik need to act fast, says Tanya Janca, head of Canadian secure coding consultancy SheHacksPurple.”Rotate every credential you can think of, right now, before you do anything else,” she said. “Then harden your CI/CD network egress controls so your build runners…
Another npm supply chain worm is tearing through dev environments

Apr 23, 2026 1:39 AM

Tags: supply-chain, worm

Plus, the payload references ‘TeamPCP/LiteLLM method’ First seen on theregister.com Jump to article: www.theregister.com/2026/04/22/another_npm_supply_chain_attack/
Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens

Apr 22, 2026 8:40 PM

Tags: breach, cybersecurity, data, supply-chain, worm

Cybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads through stolen developer npm tokens.The supply chain worm has been detected by both Socket and StepSecurity, with the companies tracking the activity under the name CanisterSprawl owing to the use of an…
DPRK Fake Job Scams Self-Propagate in ‘Contagious Interview’

Apr 22, 2026 5:39 PM

Tags: access, infection, jobs, scam, worm

A compromised developer’s repository serves as a worm-like infection vector to spread remote access Trojans (RATs) and other malware. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/dprk-fake-job-scams-self-propagate-contagious-interview
Top techniques attackers use to infiltrate your systems today

Apr 21, 2026 11:39 AM

Tags: 2fa, access, ai, api, attack, authentication, automation, business, captcha, cloud, container, control, corporate, credentials, cybercrime, cybersecurity, data, deep-fake, defense, detection, email, exploit, flaw, hacking, Hardware, identity, infrastructure, least-privilege, malicious, mfa, microsoft, monitoring, network, password, phishing, powershell, ransomware, risk, saas, scam, service, social-engineering, software, supply-chain, theft, tool, training, vpn, vulnerability, worm

Network security device hacking: Network edge devices have increasingly drawn attackers’ attention over the past two years, establishing a new battleground where the very devices meant to protect the network have become attractive targets for exploitation.As a result, flaws in security device, such as SSL VPN systems and other gateways, are among the top initial…
Industrial Systems Hit by New Email-Worm Threat Wave

Apr 17, 2026 3:39 PM

Tags: backdoor, control, cyber, data, email, malware, network, phishing, risk, technology, threat, worm

Email-borne worms are driving a fresh wave of incidents against industrial control systems (ICS), even as overall malware activity on these networks appears to be slowly declining. New data from Q4 2025 shows that phishing-driven distribution of the XWorm backdoor has sharply shifted the risk landscape for operational technology (OT) environments worldwide. The share of…
Industrial Systems Hit by New Email-Worm Threat Wave

Apr 17, 2026 3:39 PM

Tags: backdoor, control, cyber, data, email, malware, network, phishing, risk, technology, threat, worm

Email-borne worms are driving a fresh wave of incidents against industrial control systems (ICS), even as overall malware activity on these networks appears to be slowly declining. New data from Q4 2025 shows that phishing-driven distribution of the XWorm backdoor has sharply shifted the risk landscape for operational technology (OT) environments worldwide. The share of…
Industrial Systems Hit by New Email-Worm Threat Wave

Apr 17, 2026 3:39 PM

Tags: backdoor, control, cyber, data, email, malware, network, phishing, risk, technology, threat, worm

Email-borne worms are driving a fresh wave of incidents against industrial control systems (ICS), even as overall malware activity on these networks appears to be slowly declining. New data from Q4 2025 shows that phishing-driven distribution of the XWorm backdoor has sharply shifted the risk landscape for operational technology (OT) environments worldwide. The share of…
PlugX USB Worm Hits Multiple Continents via DLL Sideloading

Apr 14, 2026 3:52 PM

Tags: cyber, infection, worm

A new PlugX USB worm variant is driving fresh infection waves across several continents, using DLL sideloading and stealthy USB-based propagation to evade detection. First observed in Papua New Guinea in August 2022, the same strain resurfaced months later not only in the Pacific Rim but also in Ghana, Mongolia, Zimbabwe, and Nigeria, underscoring a…
Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses

Apr 14, 2026 2:51 PM

Tags: access, ai, api, attack, automation, cloud, credentials, crypto, data, github, guide, intelligence, kubernetes, linux, macOS, malicious, malware, open-source, pypi, risk, software, supply-chain, tactics, theft, tool, update, windows, worm

<div cla TL;DR Sonatype identified 21,764 open source malware packages in Q1 2026, bringing the total logged since 2017 to 1,346,867. npm accounted for 75% of malicious packages this quarter. Trojans dominated, with most activity focused on credential theft, host reconnaissance, and staged payload delivery. The quarter’s defining pattern was trust abuse: attackers succeeded by…
After fighting malware for decades, this cybersecurity veteran is now hacking drones

Apr 4, 2026 3:51 PM

Tags: computer, cybersecurity, hacking, malware, worm

Mikko Hyppönen is one of the most recognizable faces of the cybersecurity industry. After fighting computer viruses, worms, and malware, for more than 35 years, he tells TechCrunch why he is now working on systems to stop killer drones. First seen on techcrunch.com Jump to article: techcrunch.com/2026/04/04/after-fighting-malware-for-decades-this-cybersecurity-veteran-is-now-hacking-drones/
Bank Trojan ‘Casbaneiro’ Worms Through Latin America

Apr 2, 2026 3:51 PM

Tags: banking, cyber, detection, finance, usa, worm

Augmented Marauder’s multipronged banking-Trojan cyber campaigns are targeting Spanish speakers, evading detection, and replicating rapidly. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/bank-trojan-casbaneiro-worms-latin-america
Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper

Mar 23, 2026 10:47 AM

Tags: attack, container, cybersecurity, docker, kubernetes, malicious, radius, supply-chain, worm

Cybersecurity researchers have uncovered malicious artifacts distributed via Docker Hub following the Trivy supply chain attack, highlighting the widening blast radius across developer environments.The last known clean release of Trivy on Docker Hub is 0.69.3. The malicious versions 0.69.4, 0.69.5, and 0.69.6 have since been removed from the container image library.”New image tags 0.69.5 and…
CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive

Mar 22, 2026 12:09 AM

Tags: attack, group, malicious, threat, unauthorized, update, worm

On March 20, 2026 at 20:45 UTC, Aikido Security detected an unusual pattern across the npm registry: dozens of packages from multiple organizations were receiving unauthorized patch updates, all containing the same hidden malicious code. What they had caught was CanisterWorm, a self-spreading npm worm deployed by the threat actor group TeamPCP. We track this……
Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages

Mar 21, 2026 10:10 AM

Tags: attack, malware, supply-chain, threat, worm

The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that have led to the compromise of a large number of npm packages with a previously undocumented self-propagating worm dubbed CanisterWorm.The name is a reference to the fact that the malware uses an ICP canister,…
Horabot Returns in Mexico, Spreading via Phishing and Email Worm Attacks

Mar 19, 2026 11:09 AM

Tags: attack, banking, captcha, cyber, email, phishing, soc, worm

Horabot has resurfaced in Mexico with a more complex, multi”‘stage kill chain that blends fake CAPTCHA lures, living-off-the-land scripting, and an email worm”‘style spreader to deliver a Latin American banking trojan. In this installment of the SOC Files series, our MDR team dissected a targeted Horabot campaign that we hunted a few months ago, after…
Wikipedia hit by self-propagating JavaScript worm that vandalized pages

Mar 5, 2026 10:47 PM

Tags: security-incident, worm

The Wikimedia Foundation suffered a security incident today after a self-propagating JavaScript worm began vandalizing pages and modifying user scripts across multiple wikis. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/wikipedia-hit-by-self-propagating-javascript-worm-that-vandalized-pages/
What to Expect from Iran’s Digital Counterstrike

Mar 5, 2026 1:47 AM

Tags: attack, breach, cloud, communications, cyber, cyberattack, cybersecurity, data, defense, espionage, exploit, extortion, finance, government, group, hacking, infrastructure, intelligence, international, iran, leak, middle-east, military, network, ransomware, risk, risk-assessment, service, tool, update, vulnerability, worm

After the United States and Israel began a bombing campaign on Iran, leading to the decapitation of its political and military leaders, the Middle East has erupted into waves of kinetic warfare. But what should we expect about cyber? Iran has a formidable offensive cybersecurity capability and is considered one of the four most aggressive…
The Worm Turns When the Hunter Becomes the Hunted Mass Surveillance and the Weaponization of the Data We Voluntarily Create

Mar 4, 2026 8:47 AM

Tags: data, infrastructure, intelligence, worm

Explore how advancements in surveillance infrastructure and the democratization of intelligence have transformed espionage. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/the-worm-turns-when-the-hunter-becomes-the-hunted-mass-surveillance-and-the-weaponization-of-the-data-we-voluntarily-create/
SANDWORM_MODE: The Rise of Adaptive Supply Chain Worms

Mar 2, 2026 9:48 PM

Tags: automation, cyberattack, open-source, software, supply-chain, threat, tool, worm

<div cla Earlier this year, we asked our team where they expect open source cyberattacks to go next. Sonatype Principal Security Researcher Garrett Calpouzos shared his thoughts about how he anticipated attackers won’t simply use automation, but also abuse victims’ AI tools: First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/sandworm_mode-the-rise-of-adaptive-supply-chain-worms/
SANDWORM_MODE: The Rise of Adaptive Supply Chain Worms

Mar 2, 2026 9:48 PM

Tags: automation, cyberattack, open-source, software, supply-chain, threat, tool, worm

<div cla Earlier this year, we asked our team where they expect open source cyberattacks to go next. Sonatype Principal Security Researcher Garrett Calpouzos shared his thoughts about how he anticipated attackers won’t simply use automation, but also abuse victims’ AI tools: First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/sandworm_mode-the-rise-of-adaptive-supply-chain-worms-2/
Shai-Hulud-style NPM worm hits CI pipelines and AI coding tools

Feb 24, 2026 2:02 PM

Tags: ai, authentication, breach, cloud, control, credentials, data, identity, injection, malicious, malware, mfa, radius, tool, worm

Poisoning the AI developer interface: The campaign was specifically flagged for its direct targeting of AI coding assistants. The malware deploys a malicious Model Context Protocol (MCP) server and injects it into configurations of popular AI tools, embedding itself as a trusted component in the assistant’s environment.Once this is achieved, prompt-injection techniques can trick the…
Shai-Hulud-Like Worm Targets Developers via npm and AI Tools

Feb 23, 2026 6:01 PM

Tags: ai, malicious, malware, supply-chain, tool, worm

Supply chain worm mimicking Shai-Hulud malware spread via malicious npm packages, targeting AI tools has been identified by security researchers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/shai-hulud-like-worm-devs-npm-ai/
Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

Feb 23, 2026 1:01 PM

Tags: api, attack, credentials, crypto, cybersecurity, malicious, supply-chain, worm

Cybersecurity researchers have disclosed what they say is an active “Shai-Hulud-like” supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft.The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket. As with prior Shai-Hulud attack waves, the malicious code…
SSH Worm Exploit Detected by DShield Sensor Using Credential Stuffing and Multi-Stage Malware

Feb 12, 2026 2:58 PM

Tags: credentials, cyber, exploit, Internet, linux, malware, password, threat, worm

A DShield honeypot sensor recently recorded a complete compromise sequence involving a self-replicating SSH worm that exploits weak passwords to spread across Linux systems. The incident highlights how poor SSH hygiene and the use of default credentials remain among the most persistent threats to Internet-connected devices. Even in 2026, attackers continue leveraging automated credential stuffing…
TeamPCP Turns Cloud Infrastructure into Crime Bots

Feb 9, 2026 11:13 PM

Tags: attack, cloud, crime, data-breach, infrastructure, service, threat, worm

The threat actor has been compromising cloud environments at scale with automated worm-like attacks on exposed services and interfaces. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/teampcp-cloud-infrastructure-crime-bots