Malicious npm Packages Bypass Install-Script Detection
September 21, 2026
npm attackers hide malware in runtime code execution instead of install scripts, evading traditional supply chain defenses targeting the indexed-btree
Threat Actors
Malicious npm Packages Bypass Install-Script Detection
npm attackers hide malware in runtime code execution instead of install scripts, evading traditional supply chain defenses targeting the indexed-btree package.
ShinyHunters Breaches Clop Ransomware Leak Site, Threatens Gang
ShinyHunters extortion gang compromised Clop's Tor leak site, claiming to have stolen server data and private keys, threatening to extort the ransomware gang.
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
Four Nation-State Groups Deploy BlueMoon Kit Within 12 Days
APT31 and three additional nation-state actors deployed the BlueMoon exploit kit chaining Chrome and Windows zero-days within a two-week window, with researchers suspecting AI assistance.
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a vulnerability in Tencent's Sogou Input Method, one of the most widely used Chinese typing tools for Windows, to install GRAYRABBIT backdoor ...
Attackers Use BYOD Weaknesses to Access M365 via Graph API
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure and identify targets for extortion ...
ShinyHunters Claims Breach of Florida DMV DAVID Database
ShinyHunters extortion gang claims theft of over 200,000 driver records from Florida DMV's DAVID online platform. No official confirmation yet from the state.
Liquid Network Attackers Return 3,400 Bitcoin, Keep $47 Million
Hackers who stole nearly 4,000 bitcoin from Liquid Network returned 3,400 BTC but kept 598.5 bitcoin worth $47 million. Network remains paused pending fix.
North Korean Hackers Backdoor HAProxy in Linux Espionage Campaign
North Korean threat actors deployed a new Linux espionage toolkit targeting South Korean automotive and media firms by embedding backdoors in HAProxy load balancers.
OpenAI Agents Made 18,000 Unauthorized Edits to German Wiki
OpenAI agents made 15,000 to 18,000 autonomous edits to a German wiki over three months, evading moderation controls in unauthorized AI activity.
ShinyHunters Breaches Clop Ransomware Leak Site, Threatens Gang
September 21, 2026
ShinyHunters extortion gang compromised Clop’s Tor leak site, claiming to have stolen server data and private keys, threatening to extort
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
September 11, 2026
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September
Four Nation-State Groups Deploy BlueMoon Kit Within 12 Days
September 11, 2026
APT31 and three additional nation-state actors deployed the BlueMoon exploit kit chaining Chrome and Windows zero-days within a two-week window,
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
September 11, 2026
China-linked UNC3569 exploited a vulnerability in Tencent’s Sogou Input Method, one of the most widely used Chinese typing tools for
Attackers Use BYOD Weaknesses to Access M365 via Graph API
September 11, 2026
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure
ShinyHunters Claims Breach of Florida DMV DAVID Database
September 9, 2026
ShinyHunters extortion gang claims theft of over 200,000 driver records from Florida DMV’s DAVID online platform. No official confirmation yet
Liquid Network Attackers Return 3,400 Bitcoin, Keep $47 Million
September 9, 2026
Hackers who stole nearly 4,000 bitcoin from Liquid Network returned 3,400 BTC but kept 598.5 bitcoin worth $47 million. Network
North Korean Hackers Backdoor HAProxy in Linux Espionage Campaign
September 8, 2026
North Korean threat actors deployed a new Linux espionage toolkit targeting South Korean automotive and media firms by embedding backdoors
OpenAI Agents Made 18,000 Unauthorized Edits to German Wiki
September 8, 2026
OpenAI agents made 15,000 to 18,000 autonomous edits to a German wiki over three months, evading moderation controls in unauthorized
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.