✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Cybersecurity
Breach intelligence, attack campaigns, and threat reports targeting the Cybersecurity sector.
Explore Other Sectors
Cybersecurity Threat Reports
GlassWorm Malware: A 2026 Supply Chain Attack on Developer Ecosystems
In early 2026, the GlassWorm malware resurfaced, compromising the Open VSX Registry by infiltrating trusted developer accounts. Attackers published malicious updates to widely used VS Code extensions, embedding loaders that executed encrypted payloads to steal sensitive information, including developer credentials and cryptocurrency wallets. The malware employed advanced evasion techniques, such as using invisible Unicode characters and leveraging the Solana blockchain for command-and-control communication, making detection and mitigation challenging. This incident underscores the escalating sophistication of supply chain attacks targeting developer ecosystems. The use of decentralized infrastructures and obfuscation methods highlights the need for enhanced vigilance and security measures within software development communities to prevent similar breaches.
3 months ago
Kill Chain
Malicious Next.js Repositories Exploit Developers via Fake Job Interviews
In February 2026, a sophisticated cyberattack campaign was identified targeting software developers through malicious Next.js repositories. Attackers, linked to North Korean state-sponsored groups, posed as recruiters offering fake job interviews. They lured developers into cloning and executing compromised repositories, leading to remote code execution and establishing persistent command-and-control channels on infected machines. This method allowed attackers to access sensitive assets such as source code, environment secrets, and cloud resources. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/malicious-nextjs-repos-developers-fake-job-interviews?utm_source=openai)) This incident underscores a growing trend of targeting developers through social engineering tactics, exploiting routine workflows to infiltrate development environments. The use of legitimate platforms like Next.js and GitHub in these attacks highlights the need for heightened vigilance and robust security measures within the software development community. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/?utm_source=openai))
4 months ago
Kill Chain
Rogue NuGet Impersonates Tracer.Fody, Orchestrates Multi-Year Crypto Wallet Theft
Between February 2020 and December 2025, a malicious NuGet package named "Tracer.Fody.NLog" posed as the legitimate .NET tracing library, Tracer.Fody, and was covertly distributed via typosquatting and mimicking developer identities. The package, uploaded by a threat actor under the handle "csnemess," evaded detection for almost six years, collecting over 2,000 downloads. Instead of offering legitimate functionality, this package deployed a wallet stealer: scanning the default Stratis wallet directory on Windows systems, exfiltrating wallet data and passwords to threat actor infrastructure hosted in Russia, with attackers leveraging crafted code and hidden routines to bypass superficial code reviews. The prolonged success of this attack underscores the persistent risk supply chain threats pose to open-source ecosystems, especially for developer tools and libraries. It highlights attackers’ sophistication in mimicking trusted maintainers, the difficulty of detecting such manipulation, and ongoing regulatory and security pressures to improve package repository hygiene and detection.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports