supply chain attack
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Advertising technology firm Adform has identified a supply chain attack where hackers compromised a JavaScript file to alter cryptocurrency wallet addresses displayed on client websites. The malicious code, active around July 27, 2026, could replace legitimate wallet addresses with attacker-controlled ones when users copied them or interacted with forms. Adform has since removed the malicious code and notified affected customers, advising them to clear browser caches and verify all wallet addresses before sending funds.
Hackers abuse ViPNet software to target Russian govt agencies
An advanced threat actor, potentially Chinese-speaking, is targeting Russian government and other high-value organizations by abusing the update mechanism of ViPNet, a popular Russian cybersecurity product. The campaign, active since at least May and dubbed HelloNet, involves injecting malicious DLLs into the ViPNet update directory, which then load further malware payloads like proxies, backdoors, and log cleaners. Researchers have low confidence in the attribution due to weak evidence.
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
Researchers have identified seven malicious npm packages that were part of a software supply chain attack targeting the Vite frontend tooling ecosystem. These packages, dubbed ViteVenom, utilized a sophisticated four-tier blockchain-based command-and-control infrastructure across multiple networks to deliver a remote access trojan (RAT).
HalluSquatting Attack Exploits AI Coding Assistants to Deliver Malware
A new attack technique called HalluSquatting leverages the tendency of AI coding assistants to invent non-existent project names. Attackers can register these fabricated names and trick the AI into recommending them, thereby leading users to unknowingly install malicious software like botnet malware.
Texas Parks and Wildlife, WordPress Plugin Vendor Hit by Data Breaches
Several organizations experienced significant security incidents this week. The Texas Parks and Wildlife Department suffered a data breach affecting over 3 million customers due to a vendor compromise, exposing personal information but not financial or social security data. Additionally, a supply chain attack on WordPress plugin vendor ShapedPlugin delivered malicious updates, leading to credential theft and website modifications. AI-powered threats are also on the rise, with a new phishing service called EvilTokens exploiting device-code authentication to steal Microsoft 365 tokens.
29th June – Threat Intelligence Report
Several organizations have reported significant cyber incidents. Polymarket experienced a supply chain attack resulting in the theft of $3 million in cryptocurrency. Japanese telecom KDDI disclosed a breach affecting up to 14.22 million email accounts. Tata Electronics, a supplier to major tech firms, suffered a data breach. Brazil's National Civil Defense platform was targeted with a fake alert, and the US National Association of Insurance Commissioners confirmed a data theft via a zero-day vulnerability. Additionally, a new AI-powered phishing service called EvilTokens has been identified, exploiting authentication methods to steal Microsoft 365 tokens.
Miasma Worm Exploits Developer Credentials in Supply Chain Attacks
A sophisticated supply chain attack, dubbed Miasma, has compromised numerous npm packages, including those under the @redhat-cloud-services namespace. Attackers exploited stolen developer credentials, which lingered in underground markets for weeks before being used to poison software packages. The worm also targeted AI coding assistants, expanding its attack surface to local developer environments.