Incidents

Cyber security incidents, campaigns and responsibly disclosed issues

Name	Pub. date	Actors	Initial access	Impact	Type	Status
Supply Chain Attack Targeting LiteLLM	October 21, 2026		Supply chain vector	Supply chain attack	Campaign	Finalized
Threat Actors Targeting GCP Billing Accounts for LLM Usage	October 20, 2026		End-user compromisePassword attack	Data exfiltration	Campaign	Finalized
Wave of Cyberattacks Targeting Financial Institutions and Organizations in Japan and South Korea	October 10, 2026		1-day vulnerabilityAPI vulnerabilityWeb vulnerability	Data exfiltration	Incident	Finalized
JADEPUFFER Agentic Ransomware Targeting Cloud Environments	September 26, 2026	STORM-3168	1-day vulnerabilityExposed secret	RansomOp	Campaign	Finalized
Coder Module Registry Compromise Leads to Credential-Stealing Malware Distribution	September 1, 2026	❓Unknown		Supply chain attackData exfiltration	Incident	Stub
JetBrains Cadence Compromised via Exploitation of TeamCity Vulnerability	September 1, 2026	❓Unknown	1-day vulnerability	Supply chain attackData exfiltration	Incident	Finalized
@7nohe/openapi-react-query-codegen Compromised in Supply Chain Attack	August 28, 2026	❓Unknown	Supply chain vector	Supply chain attackData exfiltration	Campaign	Finalized
arrayref and Other Rust Crates Hijacked in Supply Chain Attack	August 20, 2026	UNC1069	Supply chain vector	Supply chain attackData exfiltration	Campaign	Finalized
Payroll Pirates Phishing Campaign Targets Microsoft 365 Financial Workflows	August 7, 2026	Payroll Pirates	End-user compromise	Data exfiltration	Campaign	Finalized
keyv and cacheable npm Package Hijacked in Supply Chain Attack	August 4, 2026	❓Unknown	Maintainer account compromise	Data exfiltrationSupply chain attack	Campaign	Finalized
CaptiveCrunch: Midnight Blizzard Hospitality Network AiTM Campaign	July 31, 2026	Storm-2945	Web vulnerabilityEnd-user compromise	Data exfiltration	Campaign	Finalized
Cl0p Exploitation of PTC Windchill and FlexPLM Vulnerability	July 22, 2026	0️⃣Cl0p	1-day vulnerability	RansomOp	Campaign	Finalized
SleeperGem: RubyGems Supply Chain Attack Targets Dormant Maintainer Accounts	July 19, 2026	❓Unknown	Maintainer account compromise	Supply chain attack	Campaign	Finalized
NadMesh: Autonomous AI-Focused Botnet Targeting Cloud and AI Infrastructure	July 17, 2026	❓Unknown	Software misconfig	Data exfiltration	Campaign	Finalized
CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign	July 16, 2026	❓Unknown	1-day vulnerability	Data exfiltration	Campaign	Finalized
AsyncAPI Supply Chain Compromise via GitHub Actions	July 14, 2026	❓Unknown	Supply chain vector	Supply chain attack	Campaign	Finalized
Cryptomining campaign targeting Linux SSH servers	July 12, 2026	❓Unknown	Password attack	Resource hijacking	Campaign	Finalized
Jscrambler npm Package Compromised in Supply Chain Attack	July 11, 2026	❓Unknown	Supply chain vector	Supply chain attackData exfiltration	Campaign	Finalized
Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys	July 9, 2026	❓Unknown	Maintainer account compromise	Resource hijackingData exfiltration	Campaign	Finalized
Coordinated GitHub API Enumeration and Access Token Abuse	July 8, 2026	❓Unknown	Exposed secret	Data exfiltration	Campaign	Finalized
Cryptojacking Campaign Targeting K8s Clusters	June 25, 2026	❓Unknown	1-day vulnerability	Resource hijackingData exfiltration	Campaign	Finalized
Klue Supply Chain Breach Leads to Salesforce Data Exfiltration	June 18, 2026	❓Unknown	Supply chain vector	Data exfiltration	Incident	Finalized
Mastra Packages Trojanized with Malicious Dependency	June 17, 2026	UNC1069	Supply chain vectorEnd-user compromise	Supply chain attack	Campaign	Finalized
FortiBleed: Credential Compromise Campaign Targeting Fortinet Devices	June 16, 2026	❓Unknown	Software misconfigExposed secret	Data exfiltration	Campaign	Finalized
Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Package	June 12, 2026	❓Unknown	Supply chain vectorEnd-user compromise	Supply chain attack	Campaign	Finalized
ServiceNow Unauthenticated Access Incident	June 9, 2026	❓Unknown	Software misconfig0-day vulnerability	Data exfiltration	Incident	Finalized
TeamPCP adds Malware to Multiple Microsoft-Linked GitHub Projects	June 5, 2026	🪱TeamPCP	Supply chain vector	Supply chain attack	Campaign	Finalized
Binding.gyp Supply Chain Attack Enables CI/CD Worm Propagation Across npm Packages	June 4, 2026	🪱TeamPCP	Supply chain vector	Supply chain attack	Campaign	Finalized
Miasma: Supply Chain Compromise in RedHat npm Packages	June 1, 2026	🪱TeamPCP	Supply chain vector	Supply chain attack	Campaign	Finalized
JINX-0164 Targeting Cryptocurrency Development Infrastructure	May 27, 2026	JINX-0164	End-user compromise	Data exfiltrationResource hijacking	Campaign	Finalized
Supply Chain Campaign Targeting Composer and GitHub Repositories	May 24, 2026	❓Unknown	Supply chain vector	Supply chain attack	Campaign	Finalized
Megalodon Campaign Backdoors GitHub Repositories via CI Workflow Compromise	May 22, 2026	❓Unknown	Supply chain vector	Data exfiltrationSupply chain attack	Campaign	Finalized
TeamPCP Claims Breach of Internal GitHub Repositories	May 20, 2026	🪱TeamPCP	Unknown	Data exfiltration	Incident	Finalized
New Mini-Shai-Hulud Wave Targets NPM, PyPi Packages and VSCode Extension	May 18, 2026	🪱TeamPCP	Supply chain vector	Supply chain attackData exfiltration	Campaign	Finalized
node-ipc npm Distribution Compromised	May 14, 2026	❓Unknown	Supply chain vector	Data exfiltration	Campaign	Finalized
Tanstack and other Packages Compromised in Supply Chain Attack	May 11, 2026	🪱TeamPCP	Supply chain vector	Data exfiltrationSupply chain attack	Campaign	Finalized
DDoS Botnet Leveraging Jenkins Misconfigurations for Initial Access	May 10, 2026	❓Unknown	Software misconfig	Denial of serviceData exfiltration	Campaign	Finalized
Compromise of Checkmarx Jenkins AST Plugin by TeamPCP	May 9, 2026	🪱TeamPCP	Supply chain vector	Data exfiltrationSupply chain attack	Campaign	Finalized
Lightning and Intercom Packages Compromised in Supply Chain Attack	April 30, 2026	🪱TeamPCP	Supply chain vector	Data exfiltrationSupply chain attack	Campaign	Finalized
Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware	April 29, 2026	🪱TeamPCP	Supply chain vector	Supply chain attackData exfiltration	Campaign	Finalized
Critical SQL Injection Vulnerability in LiteLLM Exploited in-the-Wild	April 27, 2026	❓Unknown	1-day vulnerability	Data exfiltration	Campaign	Finalized
Elementary Data Compromised in Supply Chain Attack	April 23, 2026	❓Unknown	1-day vulnerabilitySupply chain vector	Supply chain attack	Campaign	Finalized
Checkmarx KICS and Bitwarden CLI Compromised in Fresh Supply Chain Attack	April 22, 2026	🪱TeamPCP	Supply chain vector	Data exfiltrationSupply chain attack	Campaign	Finalized
Xinference Compromised in Supply Chain Attack	April 22, 2026	🪱TeamPCP	Supply chain vector	Data exfiltration	Campaign	Finalized
Context.ai OAuth Token Compromise	April 20, 2026	❓Unknown	Supply chain vector	Supply chain attackData exfiltration	Incident	Finalized
PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories	April 9, 2026	⚰️Lazarus Group	Supply chain vectorEnd-user compromise	Supply chain attackResource hijacking	Campaign	Finalized
Stolen SaaS Integration Tokens Enable Data Theft Across Snowflake Environments	April 7, 2026	🪙Bling Libra	Supply chain vector	Data exfiltration	Campaign	Finalized
O365 Device Code Phishing Campaign using EvilTokens and Abusing Railway Platform	April 7, 2026	❓Unknown	End-user compromise	Data exfiltration	Campaign	Finalized
Exploitation Campaign of Vulnerable GitHub Workflows	April 6, 2026	❓Unknown	Supply chain vector	Supply chain attack	Campaign	Finalized
UAT-10608 Campaign Abuses React2Shell for Cloud Credential Harvesting	April 2, 2026	UAT-10608	1-day vulnerability	Data exfiltration	Campaign	Finalized