Supply Chain Attacks Escalate, Ransomware Gangs Threaten Families, New Backdoor Discovered

Injective Labs SDK on npm Hijacked in Crypto-Stealing Supply Chain Attack

Supply Chain Attack: Malicious Version of Injective Labs SDK on npm Steals Crypto Wallet Keys

A sophisticated supply chain attack has compromised the official Injective Labs SDK on the npm registry. On July 9, 2026, threat actors who had gained access to the project's GitHub repository published a malicious version of the '@injectivelabs/sdk-ts' package. The compromised package contains malware designed to exfiltrate sensitive cryptocurrency data, including private keys and mnemonic seed phrases, directly from developers' environments. This incident is part of a recent wave of attacks targeting open-source software repositories to compromise downstream users.

July 10, 2026

5 min read

Supply Chain AttacknpmInjective Labscryptocurrencyinfostealer +2 more

Injective Labs SDK on npm Hijacked in Crypto-Stealing Supply Chain Attack

Ransomware Gangs Escalate to Physical Threats Against Employees and Families

HIGH

A Dark Shift: Ransomware Extortion Evolves to Include Threats of Physical Violence

A disturbing new report indicates that ransomware gangs are escalating their extortion tactics beyond digital threats to include threats of physical harm against employees, executives, and their families. As organizations become more resilient and less likely to pay ransoms, attackers are turning to real-world intimidation to pressure victims. This evolution marks a dangerous convergence of cyber and physical security, forcing companies to re-evaluate their duty of care and incident response plans to account for the safety of their personnel.

July 10, 2026

6 min read

RansomwareExtortionPhysical ThreatsThreat IntelligenceCorporate Security +1 more

Ransomware Gangs Escalate to Physical Threats Against Employees and Families

Microsoft Uncovers 'GigaWiper,' a Destructive Backdoor with Wiping and Fake Ransomware Modules

CRITICAL

Microsoft Details 'GigaWiper,' a Destructive Multi-Tool Windows Backdoor Linked to Iranian APT

Microsoft has analyzed 'GigaWiper,' a new and highly destructive Windows backdoor. This modular malware combines three separate destructive tools into one, allowing an operator to either perform a full disk wipe, overwrite the Windows drive, or deploy a 'fake ransomware' module. This third function scrambles files but does not save the encryption key, making data recovery impossible and confirming the malware's primary purpose as sabotage. GigaWiper is believed to be the work of an Iranian-backed threat actor, highlighting the continued use of wiper malware in nation-state operations.

July 10, 2026

6 min read

GigaWiperWiper MalwareMicrosoftIranAPT +2 more

Microsoft Uncovers 'GigaWiper,' a Destructive Backdoor with Wiping and Fake Ransomware Modules

Vishing Campaign Tricks Users into Enrolling Attacker Passkeys to Hack Microsoft 365 Accounts

HIGH

Threat Actor 'O-UNC-066' Targets Microsoft 365 Users with Vishing Campaign for Passkey Enrollment

A sophisticated voice phishing (vishing) campaign, attributed to a threat actor tracked by Okta as 'O-UNC-066,' is targeting Microsoft 365 users across numerous industries. Attackers call employees, impersonate IT staff, and socially engineer them into visiting a phishing site that mimics the Microsoft Entra ID portal. The goal is to trick the user into enrolling a new passkey, which is actually controlled by the attacker. This gives the threat actor persistent, passwordless access to the victim's account, which is then used for data extortion.

July 10, 2026

6 min read

VishingPhishingMicrosoft 365Entra IDPasskeys +3 more

Vishing Campaign Tricks Users into Enrolling Attacker Passkeys to Hack Microsoft 365 Accounts

Canadian Armed Forces Breached by 'Bavaqai' Threat Actor in Coordinated Attack Wave

HIGH

'Bavaqai' Threat Actor Claims Data Breach of Canadian Armed Forces Amidst Flurry of Global Cyberattacks

On July 9, 2026, the Canadian Armed Forces was reported as a victim of a data breach claimed by a threat actor self-identifying as 'Bavaqai.' While the extent of the breach is not yet public, the targeting of a major military organization raises national security concerns. This incident was disclosed alongside several other breaches on the same day, affecting a diverse range of international organizations, including US-based CorePharma (by 'Chaos'), China's Amhwa Biopharm (by 'CRPxO'), Japan's Corona Corporation (by 'Metaencryptor'), and Italy's BiesSse (by 'SpaceBears'), suggesting a widespread and potentially coordinated day of cyberattacks.

July 10, 2026

5 min read

Data BreachBavaqaiCanadian Armed ForcesChaosCRPxO +3 more

Canadian Armed Forces Breached by 'Bavaqai' Threat Actor in Coordinated Attack Wave

RubyGems Halts New Signups Amid 'Major Malicious Attack' Involving Hundreds of Packages

HIGH

RubyGems Suspends New Account Registrations Following Large-Scale Supply Chain Attack

The RubyGems package manager was forced to temporarily suspend new account registrations on July 9, 2026, after being targeted by a 'major malicious attack.' Security provider Mend.io reported that hundreds of malicious packages (gems) were uploaded to the registry. The attack appears to be two-pronged: some malicious gems were designed to target the RubyGems infrastructure itself, while others contained exploits aimed at compromising the developers who downloaded them. This incident marks another significant assault on the open-source software supply chain, prompting the drastic measure of a signup freeze to contain the threat.

July 10, 2026

5 min read

RubyGemsSupply Chain AttackRubyMalwareMend.io +1 more

Ex-Ransomware Negotiator Sentenced to 70 Months for Acting as 'Double Agent' for BlackCat Gang

MEDIUM

Former Ransomware Negotiator Angelo Martino Sentenced to 70 Months in Prison for Conspiring with BlackCat/Alphv

Angelo Martino, a former ransomware negotiator for DigitalMint, has been sentenced to 70 months in federal prison for his role in a conspiracy with the notorious BlackCat/Alphv ransomware gang. In 2023, Martino abused his insider position, acting as a 'double agent' by feeding his clients' confidential information to the criminals to help them negotiate higher ransom payments. He was involved in plots to extort $75.3 million from five U.S. organizations, highlighting a disturbing case of corruption within the cybersecurity incident response industry.

July 10, 2026

4 min read

Insider ThreatRansomwareBlackCatAlphvNegotiator +3 more

Ex-Ransomware Negotiator Sentenced to 70 Months for Acting as 'Double Agent' for BlackCat Gang

'ChocoPoC' Malware Campaign Targets Cybersecurity Researchers with Trojanized GitHub Exploits

MEDIUM

New 'ChocoPoC' Python RAT Targets Security Researchers via Weaponized PoC Exploits on GitHub

A new malware campaign is targeting the cybersecurity research community by distributing a Python-based Remote Access Trojan (RAT) named 'ChocoPoC.' The malware is cleverly delivered through weaponized proof-of-concept (PoC) exploits for various vulnerabilities hosted on GitHub. Threat actors embed the RAT into what appears to be legitimate exploit code. When a researcher downloads and runs the PoC to study a flaw, they inadvertently infect their own system, giving the attacker remote access and data-stealing capabilities. This campaign highlights the operational security risks researchers face when handling code from public repositories.

July 10, 2026

5 min read

ChocoPoCMalwareRATGitHubCybersecurity Researcher +2 more

'ChocoPoC' Malware Campaign Targets Cybersecurity Researchers with Trojanized GitHub Exploits

Supply Chain Attacks Escalate, Ransomware Gangs Threaten Families, New Backdoor Discovered