Checkmarx says function-flag, malicious since July 2025 and downloaded more than 37,000 times, is still on npm with no advisory flagging it. Advisory-based scanners have nothing to match, so finding it means checking lockfiles for the campaign's eight names.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 50%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption20
- Hype gap+15
- Incentives55
- Confidence68
Two men arrested in Australia this week are alleged TeamPCP members. The AFP estimate filed alongside the case puts the worm's take at more than 500,000 credentials and 300GB of data, and that scale makes token lifetime the live question.
Perspective Coverage
16 publishers
- Builder
- Builder 29%
- Operator
- Operator 56%
- Investor
- Investor 15%
Reality
- Evidence62
- Adoption68
- Hype gap+30
- Incentives58
- Confidence70
Microsoft documented a ClickFix variant that stages its payload in the browser cache, keeping the command the victim pastes under Windows' 260-character Run limit. Detection moves to script engines reading browser profile folders, not the pasted text.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence72
Azazel, a Russian-speaking affiliate of The Gentlemen RaaS crew, ran his own leak site to extort over two dozen victims and kept the proceeds, CloudSEK found. His way in was secrets left in old GitLab commits.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence55
buildOne report1 publisher CVSS 10.0 in Oracle's proxy tier: three federal days for a fix shipped in January
CVE-2026-21962 reached CISA's exploited-vulnerabilities catalog on August 24 with an August 27 deadline. Honeypots logged attempts in March, and Oracle's fix has been available since January.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence60
Gambit Security says the ransomware crew used a commercial coding agent for hands-on post-compromise work between 8 April and 21 May, alongside a new Linux encryptor that force-kills running guests before it touches ESXi datastores.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence78
- Adoption60
- Hype gap+22
- Incentives58
- Confidence70
CloudSEK took administrator access to the panel and counted 5,137 stolen records coming off 42 VPS nodes into five leasing affiliates' Telegram bots, with the phishing pages dark for three weeks while the panel itself stays reachable.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 60%
- Investor
- Investor 10%
Reality
- Evidence55
- Adoption30
- Hype gap+25
- Incentives40
- Confidence60
Japan's Digital Agency put the GSS leak at 246,000 records 78 days after detecting it
An intruder inside the work platform shared by Japanese ministries took names, emails and phone numbers belonging to 246,000 staff and contractors, and the agency says none of it has shown up in a confirmed case of misuse.
Reality
- Evidence42
- Adoption45
- Hype gap+35
- Incentives62
- Confidence40
Session cookies outnumber plaintext passwords four to one in BigBear 2.0's panel
CloudSEK got inside the BigBear 2.0 administrative panel and found more captured Microsoft 365 session cookies than plaintext passwords, along with code written to switch FIDO2 off on the phishing pages.
Reality
- Evidence55
- Adoption58
- Hype gap+12
- Incentives72
- Confidence56
buildOne report1 publisher BigBear 2.0 breaks WebAuthn in the browser to force a relayable MFA fallback
CloudSEK says the kit's JavaScript disrupts FIDO2 on a cloned Microsoft 365 login and steers the victim to TOTP, SMS or push, so the tenant's authentication strength policy decides whether the relay works.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+12
- Incentives50
- Confidence45
Unit 42 finds attacker-hosted NextChat in Mexico-Ecuador intrusion cluster, AI-enabled tools in second Brazil campaign
Two tracked clusters hit Mexican, Ecuadorian and Brazilian targets with living-off-the-land tradecraft, numbered batch scripts and shared SOCKS5 relays. The AI tooling they left running is the part defenders can query for.
Reality
- Evidence66
- Adoption52
- Hype gap+18
- Incentives70
- Confidence57
WSL is a working bridge, and npm hygiene stops at the container wall
CloudSEK's BRIDGEHEAD report tracks forty npm typosquats whose install script tests for Windows underneath Linux, then pulls a Rust stealer that reads the host's wallets and cookies.
Publishers:cloudsek.com
Reality
- Evidence63
- Adoption27
- Hype gap+14
- Incentives74
- Confidence56
buildOne report1 publisher 56 build-pipeline attacks, one vendor's alert queue, and the February jump nobody can attribute yet
StepSecurity's first annual report logs 56 confirmed supply chain compromises and says plainly that these are its own alerts. The February change is the finding; explaining it is the hard part.
Reality
- Evidence46
- Adoption42
- Hype gap+16
- Incentives79
- Confidence51
Silver Fox times ValleyRAT to India's GST deadline behind a real Microsoft signature
A researcher says an unreported campaign used a fake GSTR-3B overdue notice ahead of the 20 August filing deadline, delivering a patched DLL that a genuinely signed Microsoft binary loads.
Publishers:blog.himanshuanand.com
Reality
- Evidence62
- Adoption28
- Hype gap+18
- Incentives55
- Confidence54
LiteLLM's 40 minutes on PyPI: 153GB of loot, 2,488 named orgs, and the victims nobody can name
Hudson Rock's analysis of the exfiltration archive ties 118,829 CI runner dumps to 2,488 organizations. The dumps carrying no identifying metadata are the harder half.
Publishers:blog.gitguardian.com
Reality
- Evidence56
- Adoption71
- Hype gap+12
- Incentives79
- Confidence54
The 2,500-org compromise was a Trivy problem. LiteLLM was the closing act.
SOCRadar's record-level data puts 95 percent of identified victims before the poisoned LiteLLM packages ever hit PyPI. Anyone who rotated only what LiteLLM touched is still exposed.
Reality
- Evidence52
- Adoption68
- Hype gap+12
- Incentives66
- Confidence55