Loading story…
Criminal and espionage-aligned actors are increasingly using supply chain compromise as a primary access strategy, chaining vendor breaches, open-source package poisoning, credential theft, and follow-on ransomware/extortion into a “self-reinforcing” cycle. Reporting on a Group-IB trends assessment described how compromises of software packages and third parties (including examples such as the Shai-Hulud NPM worm, package poisoning activity, and SaaS/OAuth abuse) are used to inherit trusted access into customer environments—particularly via high-leverage providers like MSPs and widely used business platforms (HR/CRM/ERP). The same reporting highlighted an expected acceleration in attack speed and scale as adversaries apply AI-assisted discovery across vendors and CI/CD pipelines, and a shift toward identity-centric intrusions that blend into normal user activity.
Separate reporting described a large cross-platform campaign attributed to “RU-APT-ChainReaver-L” that used compromised distribution infrastructure—specifically file-sharing mirror services Mirrored.to and Mirrorace.org and hijacked GitHub repositories—to redirect users through deceptive chains and deliver infostealer malware signed with valid certificates and hosted via legitimate cloud services. Researchers tied the activity to credential theft observed on dark web markets and reported infrastructure at significant scale (100+ domains spanning redirectors, infection pages, and C2), with frequent tooling changes to evade antivirus detection. Other items in the set were general commentary on third-party risk, mobile-app supply chain exposure, and healthcare targeting trends, and did not provide additional, specific details about the same incidents beyond reinforcing that third-party and supply chain weaknesses are increasingly exploited for downstream compromise.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
In its report, Group-IB predicted that AI-assisted tooling will speed up vendor and pipeline targeting over the next year and that attackers will increasingly favor identity-based intrusions over traditional malware, with MSPs and HR/CRM/ERP platforms as key targets.
Group-IB reported that cybercriminals are increasingly chaining upstream breaches, credential theft, identity compromise, and ransomware into a self-reinforcing supply-chain attack ecosystem affecting open-source, SaaS, and CI/CD environments.
The campaign was described as abusing compromised mirror sites and hijacked GitHub accounts to distribute infostealer malware to Windows, macOS, and iOS users through platform-specific lures, cloud-hosted payloads, and phishing infrastructure.
GRAPH researchers said they uncovered the RU-APT-ChainReaver-L operation while investigating large volumes of stolen credentials on dark web markets, tracing infections to more than 100 domains used for redirection, malware delivery, and command-and-control.
Group-IB cited an Oracle compromise in March 2025 as an example of how a single breach can evolve into broader downstream access and follow-on compromises in supply-chain attack chains.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetheregister.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **software supply chain** threats targeting developers via public package ecosystems. Tenable analyzed a malicious npm package, **`ambar-src`**, that reached roughly **50,000 downloads** in days before removal; it executed during installation via **malicious `preinstall` behavior**, used evasion techniques, and dropped OS-specific payloads for Windows, Linux, and macOS, with typosquatting assessed as the likely lure (mimicking *`ember-source`*). Separate reporting described a campaign using **malicious NuGet packages** (e.g., **NCryptYo**, **DOMOAuth2_**, **IRAOAuth2.0**, **SimpleWriter_**) that impersonated legitimate .NET libraries, executed code on assembly load, and established local proxying/backdoor behavior to facilitate credential theft and persistence in ASP.NET environments. Additional coverage warned of an npm “worm-like” propagation pattern impacting **CI pipelines and AI coding tools**, reinforcing that developer tooling and build systems are high-risk choke points where a single poisoned dependency can spread quickly across environments. While the broader set of articles also included unrelated breach, ransomware, and policy items, the developer-focused supply chain reporting consistently emphasized that **installation-time execution** and **typosquatting/impersonation** enable compromise even when developers never directly call the malicious code, and that traditional detection can lag (e.g., low initial antivirus detection rates for obfuscated .NET payloads).
Jun 29, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026
Open-source software supply chain risk continued to escalate, with reporting citing **454,600+** newly identified malicious packages across major repositories (including **PyPI, npm, Maven Central, NuGet, and Hugging Face**) and tactics ranging from **credential theft** to **multi-stage attacks** and even early **self-replicating** package malware. The activity reportedly concentrated heavily in **npm**, including high-volume “ecosystem flooding” (e.g., single accounts publishing **150,000+** malicious packages in days) and **hijacking of trusted projects**, exploiting developer reliance on superficial trust signals such as package names, READMEs, and download counts. Separately, researchers disclosed **“PackageGate”** vulnerabilities in JavaScript package managers (**npm, pnpm, vlt, and Bun**) that can bypass common post-incident defenses—namely `--ignore-scripts` and lockfile integrity—enabling malicious code execution via compromised dependencies. Koi Security reported six issues; **pnpm, vlt, and Bun** shipped fixes, while **npm** reportedly treated the behavior as expected. In parallel, threat actors abused **GitHub’s fork architecture** to distribute a spoofed *GitHub Desktop* installer promoted via search ads; execution deployed **HijackLoader** and established persistence via a **scheduled task**, underscoring that supply chain threats extend beyond package registries into developer tooling distribution channels.
Jun 29, 2026