Tag

supply chain attack

8 stories

NetamLoader: .NET Injection Attack Hits Government Windows 10 Build in Asia

Cybersecurity researchers have disclosed a sophisticated multi-stage intrusion that targeted a government-only Windows 10 build in Asia using a previously undocumented .NET assembly-loading framework dubbed NetamLoader. Kaspersky researchers who investigated the artifact say the sample was discovered in the first half of 2026 and was packaged inside a Windows cabinet (CAB) archive placed in a directory normally used for Windows update packages. The operation appears to have used AppDomainManager injection…

Saugata DattaNov 1, 20264 min read16

Cybersecurity

Supply-chain Compromise Drains $2.7M from Polymarket After DebugBear Script Hijack

A malicious change to a third-party page-speed script on Polymarket’s site allowed attackers to use signed-in traders’ browser sessions to sell positions and siphon funds on October 29. The injected code targeted only Polymarket’s copy of a DebugBear real user monitoring (RUM) script and moved crypto to an attacker-controlled wallet in under an hour. Polymarket says it will refund roughly $2.7 million to affected wallets and is returning a total…

Saugata DattaNov 1, 20264 min read15

Cybersecurity

Polymarket’s Third-Party Breach: How Malicious Scripts Drained Wallets and What Traders Should Do Next

Polymarket suffered a security incident on October 29, 2026, when a compromised third‑party provider exposed international users to wallet theft. Traders reported missing funds, unexpected withdrawals, and positions being closed without permission. The company temporarily halted trading, said it fixed the issue, promised reimbursements for affected customers, and later resumed trading. What happened Hudson Rock’s technical investigation and subsequent reporting tied the incident to malicious JavaScript delivered through an address…

Saugata DattaOct 30, 20263 min read40

Web Development

Fake PuTTY in Google Search: How Attackers Trick IT Admins with a Trojanized Installer

IT administrators hunting for a trusted SSH client on Google can be lured to a convincing fake download page that drops a trojanized installer. The malicious MSI appears to install the legitimate PuTTY executable so the program opens and looks normal, while a stealthy Node.js-based loader runs in the background and connects to attacker-controlled infrastructure. Because the visible application behaves as expected and the bundled PuTTY binary is signed, many…

Saugata DattaOct 14, 20264 min read181

Data Breach

Bitwarden CLI Compromised in Supply Chain Attack via GitHub Actions

Socket and other researchers have confirmed that the Bitwarden CLI package published to npm — @bitwarden/cli version 2026.4.0 — was compromised in a supply chain attack that abused a GitHub Action in Bitwarden’s CI/CD pipeline. The malicious release injected a file named bw1.js into the package, exposing tokens, cloud credentials, SSH keys and other sensitive artifacts. While Bitwarden’s Chrome extension, MCP server and other official distribution channels are reported unaffected,…

Saugata DattaApr 24, 20264 min read484

Data Breach

Rockstar’s GTA Data Leak: ShinyHunters Expose 78.6M Records via Anodot–Snowflake Pivot

Rockstar Games confirmed in April 2026 that a third-party compromise led to a substantial exposure of analytics records tied to GTA Online and Red Dead Online. Although player accounts and payment systems were reportedly unaffected, the incident highlights how attackers are increasingly leveraging trusted SaaS integrations and stolen service tokens to pivot into high-value environments. This post unpacks the timeline, the nature of the data, why the attack worked, and…

Saugata DattaApr 14, 20264 min read399

Server and Virtualisation

Compromised Trust: CPUID Supply‑Chain Attack Served Trojanized CPU‑Z and HWMonitor Installers

Hackers briefly hijacked a CPUID distribution channel and altered download links on the vendor’s official website so that users seeking the popular CPU‑Z and HWMonitor utilities would instead receive a trojanized installer. The modification redirected downloads to Cloudflare R2 storage and delivered a malicious file masquerading as HWiNFO, exposing millions of users who rely on these tools for hardware diagnostics and monitoring to a potentially stealthy infostealer and multi‑stage loader.…

Saugata DattaApr 11, 20264 min read577

Data Breach

LiteLLM Supply Chain Breach — 95M Downloads, Import-Time Backdoor, and What Teams Must Do Now

The Python package ecosystem suffered another high-impact supply chain compromise: LiteLLM — a popular library that routes requests across large language model providers and sees tens of millions of downloads — shipped malicious code in recent PyPI releases. Two versions published on March 24, 2026 (1.82.7 and 1.82.8) contained an import‑time backdoor that escalates into credential harvesting, lateral movement, and a persistent remote access implant. For organizations that consume open-source…

Saugata DattaMar 25, 20265 min read588

Free Tools: IP, DNS, SSL