Find what you’re looking for

Mini Shai-Hulud 2026: Unveiling TeamPCP's npm Supply Chain Attack

In May 2026, the self-replicating malware campaign known as Mini Shai-Hulud resurfaced, compromising hundreds of npm packages. The threat actor, TeamPCP, utilized this campaign to autonomously spread malware, install persistent OS-level backdoors, and harvest sensitive credentials such as GitHub tokens, npm tokens, SSH keys, and cloud provider credentials. The malware executed upon package installation, affecting both local development environments and CI/CD pipelines, and propagated by republishing infected packages under legitimate maintainers' names. ([cyberscoop.com](https://cyberscoop.com/mini-shai-hulud-malware-npm-packages-compromised-again/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The ability of such malware to persist beyond standard remediation efforts, like package removal, highlights the need for comprehensive security measures, including thorough auditing of developer tools and CI/CD environments, to prevent unauthorized access and data exfiltration.

Verizon's 2026 DBIR: A Wake-Up Call on Exploited Vulnerabilities and Ransomware

In 2025, Verizon's Data Breach Investigations Report (DBIR) analyzed over 22,000 breaches, revealing that exploited vulnerabilities became the primary initial access vector, accounting for 31% of incidents—up from 20% the previous year. This surge underscores the challenges organizations face in timely vulnerability management, with the median time to fully patch a vulnerability increasing to 43 days from 32 days in 2024. Additionally, ransomware incidents rose to 48% of breaches, highlighting the persistent threat posed by financially motivated cybercriminals. The report also noted a decline in the remediation of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog, with only 26% fully addressed by organizations in 2025, down from 38% in 2024. This trend emphasizes the need for enhanced vulnerability management practices and proactive security measures to mitigate the evolving cyber threat landscape.

CISA Credential Leak 2026: Lessons in Cybersecurity

In May 2026, a significant security lapse was discovered involving the Cybersecurity and Infrastructure Security Agency (CISA). A contractor inadvertently exposed a public GitHub repository named 'Private-CISA,' containing sensitive credentials such as AWS GovCloud administrative keys, plaintext passwords, and SAML certificates. This repository was accessible for approximately six months, from November 2025 until its discovery in May 2026. The exposure posed substantial risks, including unauthorized access to CISA's internal systems and potential exploitation by malicious actors. ([techcrunch.com](https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/?utm_source=openai)) This incident underscores the critical importance of stringent access controls and vigilant monitoring of code repositories. It highlights the necessity for organizations to implement robust security practices, including regular audits and the use of automated tools to detect and prevent the exposure of sensitive information. The event serves as a stark reminder of the vulnerabilities associated with misconfigured repositories and the potential consequences of credential leaks.

GitHub Breach: 3,800 Internal Repositories Exfiltrated via Malicious VS Code Extension

In May 2026, GitHub experienced a security breach where approximately 3,800 internal repositories were exfiltrated. The breach occurred after an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. The attackers, identified as TeamPCP, gained access to GitHub's internal systems via this poisoned extension. GitHub has stated that there is no evidence of customer data being affected and has initiated incident response measures, including rotating critical secrets and monitoring for further activity. This incident highlights the increasing threat posed by supply chain attacks targeting developer tools and environments. Malicious extensions in widely used platforms like VS Code can serve as entry points for attackers, emphasizing the need for enhanced security measures and vigilance in software development practices.

Critical Microsoft Vulnerabilities Doubled in 2025: A Call to Action

In 2025, Microsoft disclosed 1,273 vulnerabilities, a slight decrease from the previous year. However, critical vulnerabilities surged from 78 to 157, reversing a multi-year downward trend. Notably, Elevation of Privilege vulnerabilities accounted for 40% of all CVEs, and Information Disclosure flaws rose by 73%, indicating attackers' focus on stealth and reconnaissance. Cloud platforms like Azure and Dynamics 365 saw critical vulnerabilities jump from 4 to 37, highlighting the increasing risk in these environments. This trend underscores the need for organizations to prioritize vulnerabilities that enable privilege escalation, identity abuse, and lateral movement. Traditional patch management is insufficient; a comprehensive approach addressing excessive privileges, misconfigurations, and weak identity controls is essential to mitigate these evolving threats.

7-Eleven Data Breach 2026: ShinyHunters Expose 600,000 Records

In April 2026, 7-Eleven experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers infiltrated 7-Eleven's systems, specifically targeting the company's Salesforce environment, and exfiltrated over 600,000 records containing personally identifiable information (PII) and internal corporate data. Following the breach, ShinyHunters issued a ransom demand, threatening to publicly release the stolen data if their demands were not met. When 7-Eleven declined to comply, the group proceeded to leak the data online, exposing sensitive information of numerous individuals and potentially compromising the company's operations and reputation. ([neuracybintel.com](https://www.neuracybintel.com/articles/shinyhunters-claims-7-eleven-breach-threatens-to-leak-600000-salesforce-records?utm_source=openai)) This incident underscores a growing trend among cybercriminals to exploit vulnerabilities in third-party platforms and cloud services, such as Salesforce, to gain unauthorized access to sensitive data. Organizations are increasingly being targeted through their supply chains and integrated services, highlighting the need for robust security measures and vigilant monitoring of all connected systems to prevent similar breaches.

Shai-Hulud Malware Compromises 600+ npm Packages in May 2026

In May 2026, a significant supply chain attack known as the Shai-Hulud campaign compromised over 600 npm packages, primarily targeting the @antv ecosystem. Threat actors infiltrated developer accounts to publish malicious versions of popular JavaScript libraries, including echarts-for-react, @antv/g2, and timeago.js. The malware harvested sensitive information from developer environments and CI/CD pipelines, exfiltrating data via encrypted channels to evade detection. This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the need for enhanced security measures in software development pipelines. The attackers' use of valid Sigstore provenance attestations to lend credibility to malicious packages represents a concerning evolution in attack methodologies, emphasizing the urgency for developers and organizations to implement robust verification processes and maintain vigilance against such sophisticated threats.

Storm-2949's Exploitation of SSPR in Microsoft 365 and Azure Breach

In May 2026, the threat actor known as Storm-2949 executed a sophisticated attack targeting Microsoft 365 and Azure environments. Utilizing social engineering tactics, they impersonated IT support to exploit the Self-Service Password Reset (SSPR) feature, gaining unauthorized access to privileged accounts. This access enabled them to exfiltrate sensitive data from OneDrive, SharePoint, and Azure resources, including virtual machines, storage accounts, key vaults, app services, and SQL databases. The attackers leveraged legitimate administrative tools to blend into normal operations, complicating detection efforts. This incident underscores the evolving threat landscape where attackers increasingly exploit identity management systems and cloud services. Organizations must enhance their security protocols, particularly around identity verification and access controls, to mitigate such sophisticated attacks.

Microsoft Disrupts Fox Tempest: A Cybercrime Service Exploiting Trusted Platforms

In May 2026, Microsoft disrupted a cybercrime operation known as Fox Tempest, which had been abusing Microsoft's Artifact Signing service to generate fraudulent code-signing certificates. These certificates allowed malware to be digitally signed, making it appear as legitimate software to users and operating systems. Fox Tempest created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations. The service was linked to various malware and ransomware campaigns, including those involving Oyster, Lumma Stealer, Vidar, and ransomware families such as Rhysida, Akira, INC, Qilin, and BlackByte. Microsoft seized the domain signspace[.]cloud, took hundreds of virtual machines offline, and blocked access to the infrastructure hosting the cybercrime platform. This action underscores the evolving tactics of cybercriminals who exploit trusted platforms to distribute malware, highlighting the need for continuous vigilance and adaptive security measures.

Critical ChromaDB Vulnerability (CVE-2026-45829) Exposes AI Servers to Remote Code Execution

In May 2026, a critical vulnerability identified as CVE-2026-45829 was discovered in ChromaDB's Python FastAPI server, affecting versions 1.0.0 and later. This flaw allows unauthenticated attackers to execute arbitrary code on exposed servers by sending crafted requests that exploit the server's handling of model repositories. The vulnerability arises from improper authentication checks, enabling attackers to load and execute malicious models from external sources like Hugging Face before any authentication is performed. This can lead to full server compromise, data exfiltration, and disruption of AI/ML workflows. The incident underscores the growing risks associated with AI infrastructure vulnerabilities, especially as AI applications become more integrated into critical business operations. Organizations must prioritize securing their AI systems by implementing robust authentication mechanisms, conducting regular security audits, and staying vigilant against emerging threats targeting AI platforms.

Unveiling Trapdoor: The 2026 Android Ad Fraud Scheme

In May 2026, cybersecurity researchers uncovered 'Trapdoor,' a sophisticated ad fraud and malvertising operation targeting Android users. The scheme involved 455 malicious apps and 183 command-and-control domains, creating a self-sustaining cycle of fraud. Users unknowingly downloaded utility-style apps, which then initiated malvertising campaigns, coercing them into installing additional malicious apps. These secondary apps launched hidden WebViews, loaded threat actor-controlled HTML5 domains, and requested ads, leading to 659 million daily bid requests and over 24 million app downloads, primarily affecting users in the U.S. ([thehackernews.com](https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html?utm_source=openai)) This incident highlights the evolving tactics of cybercriminals who blend legitimate tools with malicious intent, emphasizing the need for continuous vigilance and advanced detection mechanisms to protect users from such deceptive schemes.

Preventing Unauthorized AWS Account Removals: Insights from AWS CIRT

In May 2026, the AWS Customer Incident Response Team (CIRT) identified a tactic where threat actors, upon gaining control of a customer's AWS account, remove it from the AWS Organizations structure. This action bypasses Service Control Policies (SCPs) and other governance controls, leading to potential security risks and loss of centralized management. The attackers exploit permissions like `organizations:LeaveOrganization` to execute this maneuver, resulting in the account operating independently without the protective measures enforced by the organization. This incident underscores the importance of implementing strict IAM policies and SCPs to prevent unauthorized account removals. Organizations should regularly audit permissions, enforce the principle of least privilege, and monitor CloudTrail logs for `organizations:LeaveOrganization` API calls to detect and mitigate such threats promptly.