Topic
Cyberattacks that compromise trusted software distribution channels—installers, updates, or packages—to implant malware and reach downstream users.
Attackers altered files on AOMEI's update servers in windows of five to ten minutes between May and July 2026 to push a backdoor to Backupper installs. AOMEI has reported fixing its servers, but the researchers say that does not remove the backdoor from machines already hit.
Reality
Zscaler ThreatLabz says North Korea's TraderTraitor hid a malware loader inside a fake HashiCorp Terraform provider that runs the moment Terraform loads it. The crypto-theft group has pushed its operation into infrastructure-as-code, the tooling that provisions cloud environments.
Reality
Two men arrested in Australia this week are alleged TeamPCP members. The AFP estimate filed alongside the case puts the worm's take at more than 500,000 credentials and 300GB of data, and that scale makes token lifetime the live question.
Perspective Coverage
16 publishersReality
Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
Perspective Coverage
3 publishersReality
Microsoft says China-aligned NeedyMantis malware, active since at least October 2025, is installed after attackers already have access, to keep it long term. Because entry routes vary, organisations in the five sectors it targets need to look for copies already installed.
Reality
Malicious versions of three Rust crates ran code at compile time on August 20. Wiz says the infrastructure overlaps with DPRK operations, so the campaign should be treated as live.
Perspective Coverage
6 publishersReality
CISA says CVE-2026-72529 and CVE-2026-72530 are under active exploitation. For federal civilian agencies, patching an exposed instance is only half of the obligation.
Perspective Coverage
4 publishersReality
Kaspersky says malware reached Android car head units through the vendor's own update mechanism, using a flag that installs apps the device never had. The payload has no interface at all.
Perspective Coverage
8 publishersReality
Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.
Reality
Malwarebytes found Kothamine, an undocumented Windows RAT hidden in malicious npm packages, that takes its 30-plus commands over Tailscale's tailcat. The encrypted channel leaves no command-and-control domain to block, pushing detection onto the endpoint.
Reality
A credential held by a third-party app vendor gave attackers four days of access to shopper records in BigCommerce stores. Cutting off that access meant uninstalling the app.
Perspective Coverage
3 publishersReality
TeamPCP's npm compromise of TanStack reached CrowdSec through a departed employee's laptop, and the company learned its private repositories had been copied only when the code surfaced on a dark web forum in September.
Reality
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
Treasury secretary Scott Bessent ruled out liability exemptions for the frontier labs in the same week, so the labs stay inside existing law while their agents accumulate logged incidents.
Reality
Checkmarx found that indexed-btree declares no lifecycle hooks and starts its loader when application code calls set() with key 100. The loader reads its C2 address from a smart contract on Ethereum Sepolia.
Reality
TanStack closed out its package compromise on May 15th, and CrowdSec learned 124 days later that the same incident had cost it a CI credential with read access to its private code. The notice came from an outside researcher.
Reality
The developer pulled 2.35 and published 2.36, but the distribution server was still compromised, so some 2.36 downloads carried the same code and about 1,500 sites need a restore from backups taken before September 14.
Reality
A dev.to survey walks seven AI supply chain entry points and the named incidents behind each. The two dataset-poisoning numbers in it are the ones that should change how a model review is scoped.
Reality
Janis Elsts pulled the trojanised Admin Menu Editor Pro 2.35 after about seven hours and shipped 2.36 at 19:00 UTC. The intruder still held his server and backdoored that build too. At least 230 customers took the first one.
Reality
Attestation proves a package came out of the pipeline it names. When the pipeline is the thing that was owned, the seal still verifies, and a gate that only checks origin passes all 84 versions pushed on May 11.
Reality
Security · September 1, 2026 · Confirmed2 publishers
Security · September 1, 2026 · Confirmed5 publishers