#supply-chain attack
#supply-chain attack
[ follow ]
#supply-chain-attack #npm #malware #cybersecurity #phishing #credential-theft #data-breach #oauth-token-theft
fromThe Hacker News
1 week agoNation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack
"Airstalk misuses the AirWatch API for mobile device management (MDM), which is now called Workspace ONE Unified Endpoint Management," security researchers Kristopher Russo and Chema Garcia said in an analysis. "It uses the API to establish a covert command-and-control (C2) channel, primarily through the AirWatch feature to manage custom device attributes and file uploads."
Information security
fromInfoWorld
2 weeks agoSerious vulnerability found in Rust library
Researchers at Edera say they have uncovered a critical boundary-parsing bug, dubbed TARmageddon ( CVE-2025-62518), in the popular async-tar Rust library. And not only is it in this library, but also in its many forks, including the widely used tokio-tar. "In the worst-case scenario, this vulnerability has a severity of 8.1 (High) and can lead to Remote Code Execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends," the researchers say in a report.
Information security
#supply-chain-attack
Information security
fromTheStreet Crypto: Bitcoin and cryptocurrency news, advice, analysis and more
1 month agoLedger CTO warns of shocking NPM attacks by crypto hackers
Malicious actors embedded command-and-control instructions in popular NPM packages to hide malware targeting Ethereum and evade security detection.
Information security
fromThe Hacker News
2 months agoWeekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More
OAuth token theft via a Salesloft-Drift integration exposed Salesforce data across major tech firms, underscoring integration fragility and supply-chain security risks.
Information security
fromThe Hacker News
1 month agoTwo Critical Flaws Uncovered in Wondershare RepairIt Exposing User Data and AI Models
Two critical authentication-bypass vulnerabilities in Wondershare RepairIt exposed unencrypted user data and cloud resources, enabling AI model tampering, supply-chain attacks, and remote code execution.
Information security
fromTechCrunch
1 month agoSalesloft says Drift customer data thefts linked to March GitHub account hack | TechCrunch
A March GitHub breach at Salesloft allowed theft of authentication and OAuth tokens, enabling mass hacks of multiple large tech customers and a supply-chain compromise.
Information security
fromThe Hacker News
2 months agoMalicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys
Four npm packages impersonating Flashbots exfiltrate Ethereum private keys and mnemonic seeds to a Telegram bot and redirect unsigned transactions to attacker-controlled wallets.
fromTechzine Global
2 months agoHackers steal customer data from Zscaler via Salesloft leak
Following a previous series of victims, Zscaler has also been affected by a hacked Salesforce Drift instance. This resulted in the theft of customer data and information about support cases. Zscaler warns that hackers stole sensitive customer data after gaining access to their Salesforce environment. The stolen data includes customer names, email addresses, job titles, phone numbers, and location data. In addition, product licenses, commercial information, and the content of certain support cases have also been compromised.
Information security
[ Load more ]