Intel Exchange

ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.

Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.

Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.

A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.

Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.

Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM to deploy TaskWeaver, a modular Node.js loader, and Djinn Stealer, a cross-platform information stealer targeting developer and AI credentials.

An unauthenticated remote code execution vulnerability in the Argo CD repo-server component allows attackers with internal network access to take over Kubernetes clusters.

Russian-speaking threat actors are conducting a massive, automated credential-harvesting campaign named 'FortiBleed' targeting over 75,000 internet-facing Fortinet FortiGate firewalls and SSL VPNs across nearly 200 countries.

The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.

The Colombian Smugglers group and other actors utilize techniques like Device Code Phishing and SVG smuggling to deliver malware including rmrlx, vjw0rm, and UnixStealer.