Critical Flaws in MongoDB & Medical Devices, alongside Major Supply Chain Breaches at Trust Wallet and Korean Air

Trust Wallet has released a post-mortem analysis of the Chrome extension supply chain attack, now dubbed 'Shai-Hulud'. The total financial impact has increased to $8.5 million. The company confirmed that the critical Chrome Web Store API key was compromised after threat actors accessed a developer's GitHub secrets. This allowed the attackers to bypass internal security and directly upload the malicious extension. The detailed analysis provides a clearer picture of the initial compromise vector and the full extent of the financial losses, emphasizing the role of unsecured credentials in the attack.

A new fine-tuned Large Language Model (LLM) named 'DIG AI' has been discovered for sale on the dark web. This tool is explicitly designed to assist in cybercrime by generating malicious code, phishing kits, and ransomware, operating without the safety restrictions of commercial models. Available via a subscription model, DIG AI significantly lowers the technical barrier for less-skilled threat actors, enabling them to create custom malware and orchestrate complex attacks with simple natural language prompts. This development represents a critical, real-world manifestation of the 'AI Rubicon' being crossed in offensive cyber, increasing the volume and sophistication of potential attacks.

A new report on the Korean Air data breach, affecting 30,000 employees via its subsidiary KC&D, provides further details on the supply chain attack. Unlike previous reports, this article does not attribute the incident to the Clop ransomware group or the exploitation of an Oracle E-Business Suite zero-day (CVE-2025-61882). Instead, it highlights general supply chain attack vectors such as trusted relationship exploitation (T1199), valid accounts (T1078), and potential phishing (T1566) as likely initial access methods. The report emphasizes the exfiltration of sensitive PII, including names and bank account numbers, and the critical need for robust third-party risk management. The specific threat actor and initial access vector remain undisclosed in this new account.