#supply-chain-attack
#supply-chain-attack
[ follow ]
#npm #malware #cybersecurity #phishing #credential-theft #data-breach #oauth-token-theft #unc6395 #npm-packages #rust
fromThe Cipher Brief
3 weeks agoA Deniable Attack with Strategic Precision: Why the Red Hat Breach Looks More Like Statecraft Than Mere Crime
As the U.S. federal government ground to a halt at 12:01 a.m. EDT on October 1, 2025, a cybercriminal group calling itself the Crimson Collective chose that precise moment to publicly disclose one of the most significant supply chain compromises in recent memory. The breach of Red Hat's consulting division, affecting approximately 800 organizations, including critical defense contractors and government agencies, represents more than just another data breach; it demonstrates a sophisticated understanding of how to weaponize American politics for maximum strategic impact.
Information security
Information security
fromThe Hacker News
1 month agoTwo Critical Flaws Uncovered in Wondershare RepairIt Exposing User Data and AI Models
Two critical authentication-bypass vulnerabilities in Wondershare RepairIt exposed unencrypted user data and cloud resources, enabling AI model tampering, supply-chain attacks, and remote code execution.
fromjsdevspace.substack.com
1 month agoFriday Links 28: The Latest in JavaScript (Sep 19, 2025)
Chinese AI firm DeepSeek revealed it spent only $294,000 training its R1 model far below the hundreds of millions claimed by U.S. rivals. Using 512 Nvidia H800 accelerators, the company trained R1 in just 80 hours. The release of R1 earlier this year rattled tech markets, even denting Nvidia's valuation. DeepSeek also acknowledged limited use of A100s and defended model distillation, stressing it makes AI more accessible despite U.S. accusations of copying OpenAI's work.
Web development
Information security
fromTechCrunch
1 month agoSalesloft says Drift customer data thefts linked to March GitHub account hack | TechCrunch
A March GitHub breach at Salesloft allowed theft of authentication and OAuth tokens, enabling mass hacks of multiple large tech customers and a supply-chain compromise.
Information security
fromThe Hacker News
1 month agoMalicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys
Four npm packages impersonating Flashbots exfiltrate Ethereum private keys and mnemonic seeds to a Telegram bot and redirect unsigned transactions to attacker-controlled wallets.
Information security
fromDataBreaches.Net
1 month agoSalesloft Drift Breach Rolls Up Cloudflare, Palo Alto, Zscaler, and Others - DataBreaches.Net
Supply-chain attacks exploiting a Salesloft/Drift Salesforce OAuth vulnerability compromised customer Salesforce instances at Cloudflare, Palo Alto Networks, Zscaler, SpyCloud, PagerDuty, and hundreds more.
fromTechzine Global
1 month agoHackers steal customer data from Zscaler via Salesloft leak
Following a previous series of victims, Zscaler has also been affected by a hacked Salesforce Drift instance. This resulted in the theft of customer data and information about support cases. Zscaler warns that hackers stole sensitive customer data after gaining access to their Salesforce environment. The stolen data includes customer names, email addresses, job titles, phone numbers, and location data. In addition, product licenses, commercial information, and the content of certain support cases have also been compromised.
Information security
Software development
fromInfoQ
6 months agoGoogle Go Module Mirror Served Backdoor for 3+ Years
Research uncovered a major supply chain attack in the Go ecosystem involving a backdoored package.
The attack exploited caching in the Go Module Proxy, emphasizing security vulnerabilities in module management.
[ Load more ]