Threat Intelligence Center

A campaign attributed to the threat actor WhiteCobra distributed trojanized VS Code extensions impersonating Solidity development tooling, including helper-beeps.solidity-pro, web3devtoolsx.solidity-pro, and ethdevtools.solidity-language-support, alongside packages such as @jaymara/jsononifier, ascii-fetcher, Zlmiles.zlmiles-liquid, and DigitalBarberTrim.html-entity-codec.

Atlassian Rovo, the AI assistant integrated with Atlassian's enterprise tooling, contained a one-click flaw that let a prompt injection attack expose enterprise data. A single user interaction was enough to trigger it, which places the vulnerability class squarely in the same category as other one-click browser and application exploits.

A guest diary published by the SANS Internet Storm Center examines automated SSH activity captured with the Cowrie honeypot, showing how quickly scripted actors act once credentials succeed.

A breach at TrueConf let the Head Mare group trojanize the vendor's client installers, turning a routine software download into a backdoor delivery channel. The campaign's payloads are PhantomCore and PhantomGraph, with malicious components named SysExcSvc.dll and SysReadSvc.dll. A separate April campaign, Operation True Chaos, exploited CVE-2026-3502 to deliver the Havoc implant.

ClickFix attacks, which trick users into executing attacker-supplied commands themselves, are being used to deliver macOS infostealer malware. Payloads observed in these campaigns include Atomic Stealer, Lumma Stealer, MacSync and Remus, with infrastructure connected to the Aeza Group.

Trojanized releases of the npm packages keyv and cacheable have been tied to the Shai-Hulud worm, which spreads through the JavaScript package ecosystem rather than targeting any single industry. The activity involves abuse of the Bun runtime alongside artifacts identified as setup.mjs, Math_Symbol.js, and gh-token-monitor.