Ticker feed
TeamPCP hackers compromised over 170 packages across major software projects on May 11, including 42 TanStack packages, 65 UiPath packages, and Mistral AI's PyPI packages.
The "Mini Shai-Hulud" attack chained three weaknesses in TanStack's GitHub Actions — ending with an OIDC token lifted straight out of runner memory — to hijack the pipeline and publish malicious packages carrying valid SLSA provenance. Tenable tracks the chain as CVE-2026-45321, CVSS 9.6. Provenance proves which pipeline built a package, not that the pipeline was behaving.
The malware steals developer credentials, API keys, cryptocurrency wallets, and cloud secrets, and spreads by using stolen tokens to publish infected versions of other packages. For the first time, its Python variant went after password managers including 1Password and Bitwarden, and it used the decentralized Session network for harder-to-disrupt exfiltration.
Check for compromised versions and audit your GitHub Actions configuration — then clean up in the right order. The malware runs a daemon that polls GitHub every minute to see whether its stolen token has been revoked, and revocation triggers a destructive wipe. Isolate and image the machine first, clear the persistence it leaves behind in .claude and .vscode, and rotate credentials after that.
Source: SecurityWeek
TeamPCP hackers compromised over 170 packages across major software projects on May 11, including 42 TanStack packages, 65 UiPath packages, and Mistral AI's PyPI packages.
The "Mini Shai-Hulud" attack chained three weaknesses in TanStack's GitHub Actions — ending with an OIDC token lifted straight out of runner memory — to hijack the pipeline and publish malicious packages carrying valid SLSA provenance. Tenable tracks the chain as CVE-2026-45321, CVSS 9.6. Provenance proves which pipeline built a package, not that the pipeline was behaving.
The malware steals developer credentials, API keys, cryptocurrency wallets, and cloud secrets, and spreads by using stolen tokens to publish infected versions of other packages. For the first time, its Python variant went after password managers including 1Password and Bitwarden, and it used the decentralized Session network for harder-to-disrupt exfiltration.
Check for compromised versions and audit your GitHub Actions configuration — then clean up in the right order. The malware runs a daemon that polls GitHub every minute to see whether its stolen token has been revoked, and revocation triggers a destructive wipe. Isolate and image the machine first, clear the persistence it leaves behind in .claude and .vscode, and rotate credentials after that.
Source: SecurityWeek
The exploit was real, and the plan was mass exploitation. A criminal group built it with AI help; Google's Threat Intelligence Group found it first, worked with the vendor on a fix, and disrupted the operation before it ran. Neither the group nor the tool, a popular open-source web administration platform, has been named.
The Python script bypassed 2FA — it needs valid credentials to start — by exploiting a hardcoded trust assumption in the enforcement logic, the kind of semantic flaw scanners miss. GTIG has high confidence an AI model helped: educational docstrings, textbook Pythonic structure, a hallucinated CVSS score. It doesn't believe Gemini was used.
State actors are scaling the same approach: China's UNC2814 posed as a binary security expert to get Gemini auditing TP-Link firmware, and North Korea's APT45 fired thousands of recursive prompts at CVEs and PoC exploits. GTIG notes frontier models still struggle with complex enterprise authorization logic.
PROMPTSPY is the sharper end: an Android backdoor that reads the on-screen UI, sends it to gemini-2.5-flash-lite, and acts on the JSON commands it gets back — clicking and swiping through the device unsupervised. No PROMPTSPY apps reached Google Play, and Play Protect covers known versions.
Russian operators padded CANFAIL and LONGSTREAM with LLM-written decoy code — 32 daylight-saving queries in one downloader — so malware reads as benign. TeamPCP monetised credentials stolen via SANDCLOCK through ransomware partnerships. Google disabled the accounts involved; the Big Sleep agent found the flaw in time, and CodeMender, which proposes fixes, is still experimental.
Source: Cybersecurity News
The exploit was real, and the plan was mass exploitation. A criminal group built it with AI help; Google's Threat Intelligence Group found it first, worked with the vendor on a fix, and disrupted the operation before it ran. Neither the group nor the tool, a popular open-source web administration platform, has been named.
The Python script bypassed 2FA — it needs valid credentials to start — by exploiting a hardcoded trust assumption in the enforcement logic, the kind of semantic flaw scanners miss. GTIG has high confidence an AI model helped: educational docstrings, textbook Pythonic structure, a hallucinated CVSS score. It doesn't believe Gemini was used.
State actors are scaling the same approach: China's UNC2814 posed as a binary security expert to get Gemini auditing TP-Link firmware, and North Korea's APT45 fired thousands of recursive prompts at CVEs and PoC exploits. GTIG notes frontier models still struggle with complex enterprise authorization logic.
PROMPTSPY is the sharper end: an Android backdoor that reads the on-screen UI, sends it to gemini-2.5-flash-lite, and acts on the JSON commands it gets back — clicking and swiping through the device unsupervised. No PROMPTSPY apps reached Google Play, and Play Protect covers known versions.
Russian operators padded CANFAIL and LONGSTREAM with LLM-written decoy code — 32 daylight-saving queries in one downloader — so malware reads as benign. TeamPCP monetised credentials stolen via SANDCLOCK through ransomware partnerships. Google disabled the accounts involved; the Big Sleep agent found the flaw in time, and CodeMender, which proposes fixes, is still experimental.
Source: Cybersecurity News
Checkmarx warned users on May 9 that hackers had published a malicious version of its Jenkins AST plugin — 2026.5.09 — to the Jenkins Marketplace. The plugin, which wires Checkmarx One scanning into Jenkins pipelines, carried a stealer going after crypto wallets, VPN configs, and AWS and GitHub credentials on Windows, Linux and macOS.
The company told users to fall back to version 2.0.13-829.vc72453fa_1c16 from December 2025, then released two newer builds over the weekend; 2.0.13-848.v76e89de8a_053 is now on GitHub and the Jenkins Marketplace. Updating isn't enough on its own — Checkmarx says to rotate every secret its CI runners could reach, from GitHub tokens to cloud and Kubernetes credentials.
The compromise traces back to March's Trivy supply chain attack, which handed TeamPCP the credentials to reach Checkmarx's GitHub repositories. Malicious artifacts followed in late March and again on April 22, and Checkmarx says LAPSUS$ published the stolen data on April 25.
Updated August 13, 2026: Mandiant confirmed the incident contained on June 4, and Checkmarx announced its investigation complete on July 6.
Source: Security Week
Checkmarx warned users on May 9 that hackers had published a malicious version of its Jenkins AST plugin — 2026.5.09 — to the Jenkins Marketplace. The plugin, which wires Checkmarx One scanning into Jenkins pipelines, carried a stealer going after crypto wallets, VPN configs, and AWS and GitHub credentials on Windows, Linux and macOS.
The company told users to fall back to version 2.0.13-829.vc72453fa_1c16 from December 2025, then released two newer builds over the weekend; 2.0.13-848.v76e89de8a_053 is now on GitHub and the Jenkins Marketplace. Updating isn't enough on its own — Checkmarx says to rotate every secret its CI runners could reach, from GitHub tokens to cloud and Kubernetes credentials.
The compromise traces back to March's Trivy supply chain attack, which handed TeamPCP the credentials to reach Checkmarx's GitHub repositories. Malicious artifacts followed in late March and again on April 22, and Checkmarx says LAPSUS$ published the stolen data on April 25.
Updated August 13, 2026: Mandiant confirmed the incident contained on June 4, and Checkmarx announced its investigation complete on July 6.
Source: Security Week
In February 2018, Mordechai Guri's team at Ben-Gurion University published ODINI: proof-of-concept malware that lifts data off an air-gapped computer sitting inside a Faraday cage. Overload the CPU cores, and the low-frequency magnetic fields you generate pass straight through shielding designed to stop radio. Forty bits per second at 100 to 150 centimetres.
Its companion, MAGNETO, dispensed with the dedicated receiver: an Android app read the phone's own magnetometer at 5 bits per second from 12.5 centimetres, and kept working with the handset in airplane mode or zipped inside a Faraday bag. Enough for passwords, tokens, keystrokes and keys. Not enough for files.
Both papers rested on one assumption — that something had already infected the isolated machine. ESET closed that gap in October 2024, reporting what it called the first confirmed compromise of air-gapped systems: GoldenJackal toolsets at a European government body from May 2022 to March 2024. Infected USB drives carried the malware in, then carried emails, documents and keys out.
The channel research didn't stop either. The same lab has since turned RAM into a radio transmitter with RAMBO and LCD panels into speakers with PIXHELL, and in June 2025 published SmartAttack — ultrasonic signals at 18 to 22 kHz, picked up by a compromised Wear OS smartwatch at up to 50 bits per second over more than six metres.
Defences haven't moved much. Mu-metal shielding works and costs accordingly. Jamming works, with field generators or free in software by injecting random CPU load. Zoning is the one that survives contact with a budget — and it now has to cover watches and phones, not just laptops.
Source: Cybersecurity News · ESET via BleepingComputer · SecurityWeek
In February 2018, Mordechai Guri's team at Ben-Gurion University published ODINI: proof-of-concept malware that lifts data off an air-gapped computer sitting inside a Faraday cage. Overload the CPU cores, and the low-frequency magnetic fields you generate pass straight through shielding designed to stop radio. Forty bits per second at 100 to 150 centimetres.
Its companion, MAGNETO, dispensed with the dedicated receiver: an Android app read the phone's own magnetometer at 5 bits per second from 12.5 centimetres, and kept working with the handset in airplane mode or zipped inside a Faraday bag. Enough for passwords, tokens, keystrokes and keys. Not enough for files.
Both papers rested on one assumption — that something had already infected the isolated machine. ESET closed that gap in October 2024, reporting what it called the first confirmed compromise of air-gapped systems: GoldenJackal toolsets at a European government body from May 2022 to March 2024. Infected USB drives carried the malware in, then carried emails, documents and keys out.
The channel research didn't stop either. The same lab has since turned RAM into a radio transmitter with RAMBO and LCD panels into speakers with PIXHELL, and in June 2025 published SmartAttack — ultrasonic signals at 18 to 22 kHz, picked up by a compromised Wear OS smartwatch at up to 50 bits per second over more than six metres.
Defences haven't moved much. Mu-metal shielding works and costs accordingly. Jamming works, with field generators or free in software by injecting random CPU load. Zoning is the one that survives contact with a budget — and it now has to cover watches and phones, not just laptops.
Source: Cybersecurity News · ESET via BleepingComputer · SecurityWeek
The hacking group ShinyHunters attacked Canvas, the academic software used by thousands of schools, disrupting approximately 9,000 institutions across the US, Canada, and Australia during critical end-of-year exams.
Students at Mississippi State University were mid-exam when ransom notes suddenly appeared on their screens, demanding bitcoin payment and threatening to release stolen data. The university postponed Friday's finals to help students recover lost work.
Major universities including Penn State, University of Sydney, and UCLA cancelled or rescheduled exams as Canvas remained largely offline. By Thursday evening, Canvas owner Instructure reported the platform was "available for most users," though many schools still experienced outages Friday.
Students expressed anxiety about completing coursework and potential data breaches, while universities scrambled to communicate updates and reschedule critical assessments during this high-stakes academic period.
Source: BBC
The hacking group ShinyHunters attacked Canvas, the academic software used by thousands of schools, disrupting approximately 9,000 institutions across the US, Canada, and Australia during critical end-of-year exams.
Students at Mississippi State University were mid-exam when ransom notes suddenly appeared on their screens, demanding bitcoin payment and threatening to release stolen data. The university postponed Friday's finals to help students recover lost work.
Major universities including Penn State, University of Sydney, and UCLA cancelled or rescheduled exams as Canvas remained largely offline. By Thursday evening, Canvas owner Instructure reported the platform was "available for most users," though many schools still experienced outages Friday.
Students expressed anxiety about completing coursework and potential data breaches, while universities scrambled to communicate updates and reschedule critical assessments during this high-stakes academic period.
Source: BBC
The RansomHouse ransomware group claimed responsibility for hacking cybersecurity firm Trellix, targeting part of the company's source code repository. Trellix confirmed the breach this week but stated no evidence suggests their source code distribution was compromised or exploited.
RansomHouse posted screenshots on Thursday showing access to Trellix's internal services and management dashboards, though they haven't specified what data was stolen. The timing suggests possible links to recent supply chain attacks by TeamPCP and Lapsus$ that hit other security firms like Checkmarx and Bitwarden.
RansomHouse, active since 2022, operates as ransomware-as-a-service and has listed over 170 victims on their leak site.
Source: SecurityWeek
The RansomHouse ransomware group claimed responsibility for hacking cybersecurity firm Trellix, targeting part of the company's source code repository. Trellix confirmed the breach this week but stated no evidence suggests their source code distribution was compromised or exploited.
RansomHouse posted screenshots on Thursday showing access to Trellix's internal services and management dashboards, though they haven't specified what data was stolen. The timing suggests possible links to recent supply chain attacks by TeamPCP and Lapsus$ that hit other security firms like Checkmarx and Bitwarden.
RansomHouse, active since 2022, operates as ransomware-as-a-service and has listed over 170 victims on their leak site.
Source: SecurityWeek
The ShinyHunters cybercrime gang has breached Instructure's Canvas learning platform twice in quick succession, affecting nearly 9,000 educational institutions and 275 million users during final exam week. Despite Instructure claiming the initial April 25 attack was contained by May 2, hackers struck again on May 7, forcing the company to take Canvas offline once more.
The attackers exploited vulnerabilities in "free-for-teacher" accounts and claim to have stolen 3.65TB of data, including names, emails, student IDs, and billions of private messages between students and teachers. The breach spans universities, K-12 schools, and major corporations like Amazon and Apple across multiple countries.
Students report being locked out during critical study periods, with ransom messages appearing instead of their grades. The incident raises serious concerns about data protection for minors and the security standards expected from platforms serving such massive educational networks.
Source: Dark Reading
The ShinyHunters cybercrime gang has breached Instructure's Canvas learning platform twice in quick succession, affecting nearly 9,000 educational institutions and 275 million users during final exam week. Despite Instructure claiming the initial April 25 attack was contained by May 2, hackers struck again on May 7, forcing the company to take Canvas offline once more.
The attackers exploited vulnerabilities in "free-for-teacher" accounts and claim to have stolen 3.65TB of data, including names, emails, student IDs, and billions of private messages between students and teachers. The breach spans universities, K-12 schools, and major corporations like Amazon and Apple across multiple countries.
Students report being locked out during critical study periods, with ransom messages appearing instead of their grades. The incident raises serious concerns about data protection for minors and the security standards expected from platforms serving such massive educational networks.
Source: Dark Reading
Security researchers at Adversa AI discovered a critical vulnerability called "TrustFall" affecting popular AI coding tools including Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI. The flaw allows malicious repositories to automatically execute harmful code on developers' systems with minimal user interaction.
The attack works when developers clone a malicious repo and accept what appears to be a routine trust dialog. This triggers an auto-approved Model Context Protocol (MCP) server that runs with full system privileges, potentially stealing SSH keys, installing backdoors, or establishing remote control connections.
Anthropic recently weakened Claude Code's warning language in version 2.1, removing explicit MCP execution warnings and defaulting to trust mode. The vulnerability becomes even more dangerous in CI/CD environments where no human interaction is required for code execution.
Source: Dark Reading
Security researchers at Adversa AI discovered a critical vulnerability called "TrustFall" affecting popular AI coding tools including Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI. The flaw allows malicious repositories to automatically execute harmful code on developers' systems with minimal user interaction.
The attack works when developers clone a malicious repo and accept what appears to be a routine trust dialog. This triggers an auto-approved Model Context Protocol (MCP) server that runs with full system privileges, potentially stealing SSH keys, installing backdoors, or establishing remote control connections.
Anthropic recently weakened Claude Code's warning language in version 2.1, removing explicit MCP execution warnings and defaulting to trust mode. The vulnerability becomes even more dangerous in CI/CD environments where no human interaction is required for code execution.
Source: Dark Reading
The hacking group ShinyHunters targeted Instructure's Canvas learning management system Thursday, forcing thousands of schools offline during finals week. Major universities including Penn State, UCLA, Columbia, and Northwestern were affected, with Penn State canceling all tests and warning students of no access for 24 hours.
Canvas was restored for most users by Thursday night, but the hackers claim they accessed nearly 9,000 schools worldwide and billions of private messages. The group threatened to leak stolen data, setting deadlines of Thursday and May 12, suggesting ongoing extortion negotiations. This attack mirrors recent breaches at PowerSchool and other educational platforms, highlighting schools' vulnerability as prime targets for cybercriminals seeking digitized student data.
Source: CBS News
The hacking group ShinyHunters targeted Instructure's Canvas learning management system Thursday, forcing thousands of schools offline during finals week. Major universities including Penn State, UCLA, Columbia, and Northwestern were affected, with Penn State canceling all tests and warning students of no access for 24 hours.
Canvas was restored for most users by Thursday night, but the hackers claim they accessed nearly 9,000 schools worldwide and billions of private messages. The group threatened to leak stolen data, setting deadlines of Thursday and May 12, suggesting ongoing extortion negotiations. This attack mirrors recent breaches at PowerSchool and other educational platforms, highlighting schools' vulnerability as prime targets for cybercriminals seeking digitized student data.
Source: CBS News
Daemon Tools developer Disc Soft confirmed hackers compromised their software distribution between April 8 and May 5, infecting thousands of computers with malware. Chinese-speaking attackers injected trojanized code into Daemon Tools Lite version 12.5.1 downloads from the official website.
Kaspersky discovered the breach affected government, scientific, manufacturing, and retail organizations across Belarus, Russia, and Thailand. The attackers selected about a dozen victims for deeper infiltration, including a Russian educational institution hit with a complex backdoor.
Disc Soft has contained the incident, rebuilt clean installation packages, and released version 12.6.0.2445 on May 5. Users who downloaded the compromised version must uninstall the software and scan for malware.
Source: Security Week
Daemon Tools developer Disc Soft confirmed hackers compromised their software distribution between April 8 and May 5, infecting thousands of computers with malware. Chinese-speaking attackers injected trojanized code into Daemon Tools Lite version 12.5.1 downloads from the official website.
Kaspersky discovered the breach affected government, scientific, manufacturing, and retail organizations across Belarus, Russia, and Thailand. The attackers selected about a dozen victims for deeper infiltration, including a Russian educational institution hit with a complex backdoor.
Disc Soft has contained the incident, rebuilt clean installation packages, and released version 12.6.0.2445 on May 5. Users who downloaded the compromised version must uninstall the software and scan for malware.
Source: Security Week
