Loading story…
Zapier patched a five-stage exploit chain disclosed by Token Security that could have let an attacker with only a free account gain broad control over the automation platform and abuse millions of users’ connected services. Researchers said the chain started in Code by Zapier running on AWS Lambda, where discarded credentials and live STS session tokens could be recovered from process memory after environment-variable scrubbing failed to clear heap memory. Those tokens reportedly enabled access to internal AWS resources, including an ECR storage environment containing more than 1,100 private software images, where image history exposed a leaked NPM publish token with write access to key Zapier packages.
With that token, an attacker could have modified public developer SDK packages and internal components such as zapier-design-system, which loads in every authenticated Zapier browser session, creating a path to execute malicious code in logged-in users’ browsers. Researchers said that access could have allowed impersonation of legitimate users inside Zapier, alteration of automations, and triggering of actions across integrated email, storage, database, and messaging services without directly stealing external account passwords; they also found a live key tied to an external AI company executive account used internally by Zapier and demonstrated the risk by sending an email from that Gmail account. Zapier said it triaged the February report within four days, revoked the leaked token and tightened AWS permissions by February 16, completed remediation by March 5, paid a $3,000 bug bounty, and found no evidence of exploitation, customer data access, or required customer action.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Zapier confirmed remediation of the reported issues, completing fixes for the chained weaknesses that researchers said could have enabled widespread account takeover and abuse of connected services. Zapier and the researchers said they found no evidence of exploitation, no customer action was required, and no customer data or credentials were accessed.
Zapier revoked the leaked NPM publish token and tightened the affected AWS role as part of its response to the reported exploit chain. This occurred after Zapier triaged the report within four days of submission.
Token Security submitted a report to Zapier describing a five-stage exploit chain that could let an attacker with a free Zapier account escalate to write access for Zapier packages and code loaded in authenticated user sessions. The report covered weaknesses spanning Code by Zapier, AWS permissions, container images, and NPM publishing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcecyberscoop.com
Open sourcehelpnetsecurity.com
Open sourcetoken.security
Open sourcetoken.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the `prt-scan` campaign abused misconfigured GitHub Actions workflows using the `pull_request_target` trigger to run attacker-controlled code from forked pull requests in privileged CI contexts. The actor used at least six GitHub accounts to submit more than 500 malicious pull requests across six waves, disguising many as routine CI updates and tailoring payloads to Python, Node.js, Go, Rust, and GitHub Actions repositories. Wiz said the operation evolved from simple bash payloads into AI-assisted, repository-aware implants designed to steal `GITHUB_TOKEN` values, enumerate secrets, probe cloud metadata services, and exfiltrate credentials through workflow logs and pull request comments. The campaign succeeded often enough to cause real supply-chain impact despite an estimated success rate below 10%. Wiz confirmed compromise of the npm packages **`@codfish/eslint-config`** and **`@codfish/actions`** across 106 versions, and verified theft of AWS keys, Cloudflare API tokens, and Netlify authentication tokens. High-profile projects including Sentry, OpenSearch, IPFS, NixOS, Jina AI, and recharts reportedly blocked the attempts through contributor approval gates and workflow restrictions. The activity follows earlier warnings from Sysdig that insecure use of `pull_request_target` in prominent repositories such as MITRE, Splunk, and Spotipy could expose secrets and high-privilege `GITHUB_TOKEN` permissions, underscoring that unsafe GitHub Actions defaults remain an active software supply-chain risk.
Jun 29, 2026
Several vendors and security trackers reported **high-impact vulnerabilities** with exploitation risk, alongside separate **social-engineering-driven breaches**. Zoom disclosed a **command injection** issue in Zoom Node Multimedia Routers (MMRs) used in certain hybrid meeting environments, tracked as **CVE-2026-22844** (reported with a high technical severity), which could allow meeting participants to execute arbitrary code; administrators were advised to update to *Zoom* version **5.2.1716.0**. SmarterTools reported a critical **authentication bypass** in *SmarterMail* (**CVE-2026-23760**) that could allow unauthenticated attackers to reset admin passwords via the `force-reset-password` API endpoint and potentially reach OS command execution and full remote code execution; mitigations included upgrading to **Build 9511**, resetting admin passwords, and enabling MFA. Separately, *Vite* was reported as affected by an **improper access control** flaw (**CVE-2025-31125**) enabling exposure of sensitive files by bypassing `server.fs.deny` protections using crafted query parameters (e.g., `?inline&import` or `?raw&import`); the issue was noted as being exploited in the wild and added to the **CISA Known Exploited Vulnerabilities** catalog. SC Media also reported active exploitation of an *Appsmith* **authentication flaw** (**CVE-2026-22794**) tied to the password reset flow, enabling account takeover by leaking reset tokens; defenders were urged to upgrade to **Appsmith 1.93**, which tightens Origin header validation and trusted base URL enforcement. In parallel to these vulnerability-driven risks, the Canadian Investment Regulatory Organization (**CIRO**) disclosed a **phishing-led breach** affecting ~**750,000** investors with exposure of highly sensitive identifiers (including social insurance numbers and investment information), while Betterment confirmed **unauthorized access via social engineering** that exposed customer contact/identity data and was used to send fraudulent cryptocurrency-scam notifications to users.
Jun 29, 2026
Praetorian reported an attack chain in which adversaries combine two seemingly lower-severity weaknesses—**abusable public-facing email/newsletter API endpoints** and **verbose error handling that leaks OAuth 2.0 bearer tokens**—to achieve high-impact compromise. In the first step, attackers manipulate unauthenticated JSON parameters (e.g., recipient, subject, body) in business-logic-driven endpoints (such as newsletter signups/contact forms/password resets) to force an organization’s own infrastructure to send attacker-crafted emails. Because the messages are sent by authorized systems, they *pass* SPF/DKIM/DMARC checks and are more likely to land in users’ primary inboxes, effectively turning trusted infrastructure into a phishing delivery mechanism. The second step escalates impact when malformed requests (including incomplete or invalid JSON) trigger debugging responses that return stack traces and inadvertently expose **OAuth access tokens** used by internal services. With stolen tokens—often usable against **Microsoft Graph** depending on configured scopes—attackers can access Microsoft 365 resources without needing user credentials, potentially enabling broad tenant compromise. The reporting emphasizes that the protocols (SPF/DMARC) are not “broken”; rather, attackers are exploiting legitimate sending paths and poor error hygiene, illustrating how **vulnerability chaining** can turn medium/low issues into a critical compromise path.
Jun 29, 2026