Supply Chain Worm, Ransomware, and AI-Powered Phishing Dominate Cybersecurity News

Critical Threats and Exploitation:

• NPM Package 'tensorlake' Hit by Self-Propagating Supply Chain Worm: The 'tensorlake' NPM package was compromised with a worm from the 'Shai-Hulud' family. The malicious version, 0.5.144, harvests credentials from developer environments, including CI/CD pipelines, AWS, Kubernetes, and cryptocurrency wallets, and uses stolen credentials to automatically republish compromised versions of other packages. An Ethereum smart contract is used for command-and-control.
• Ransomware Attack Cripples Japanese Cloud Provider IDCF Cloud: IDC Frontier, a SoftBank subsidiary, experienced a significant ransomware attack on its IDCF Cloud service, impacting its 'East Japan Region 1' data center. The attack caused a widespread outage affecting 495 corporate and local government clients, with attackers claiming to have encrypted 3.6 PB of data.
• APT Uses AI and QR Codes in Phishing Attack on Taiwan Researchers: An unidentified APT group is targeting Taiwanese research organizations with spear-phishing campaigns. Attackers are using AI-generated content for email lures, QR code phishing ('quishing'), and an adversary-in-the-middle (AitM) framework to intercept credentials and bypass MFA, impersonating Google login pages.
• North Korean Hackers Use Public Blockchain for Covert C2 Channel: The North Korea-affiliated group Alluring Pisces is employing a public blockchain for resilient command-and-control (C2) communications in cloud supply chain attacks. This technique is used in campaigns like 'ChainDrop' and 'PolinRider' to poison open-source packages and steal cloud credentials.
• New 'Wazza' Phishkit Uses Advanced Evasion to Target Global Orgs: A new phishing kit named 'Wazza' is targeting banking, manufacturing, and government organizations globally. It employs a multi-stage routing chain to filter out security scanners and sandboxes, ensuring the final phishing page, often an Adobe-themed lure for Device Code phishing, is only delivered to human victims.

Industry Trends and Advisories:

• Phishing Attacks Abusing Legitimate RMM Tools Surge by 475%: Phishing campaigns leveraging legitimate Remote Monitoring and Management (RMM) tools have seen a 475% increase in the first nine months of 2026 compared to all of 2025. These attacks primarily target North American financial institutions, with attackers tricking victims into granting remote access. A separate campaign uses Microsoft Power BI domains to host lures for rogue ScreenConnect installers.
• FBI: China-Linked Hackers Gave Third Parties Access to Stolen Emails: Hackers linked to Integrity Technology Group operated a web portal to provide third-party access to stolen email content. Active since at least January 2021, the campaign targeted various sectors globally, compromising Microsoft 365 and Exchange accounts to exfiltrate entire mailboxes.

Legal and Enforcement Actions:

• Owner of Ransomware Recovery Firm Charged with Wire Fraud: Zohar Pinhasi, owner of MonsterCloud, has been indicted on wire fraud charges. He is accused of falsely claiming his company could decrypt data without paying a ransom, while secretly negotiating with and paying attackers, then charging victims for services while concealing the ransom payment.