script.sh

• North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack

  North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack Written by: Austin Larsen, Dima Lenz, Adrian Hernandez, Tyler McLellan, Christopher Gardner, Ashley Zaya, Michael Rudden, Mon Liclican, Muhammad Umair Introduction Google Threat Intel

• Bad Apples: Weaponizing native macOS primitives for movement and execution

  Bad Apples: Weaponizing native macOS primitives for movement and execution Cisco Talos documents several macOS living-off-the-land (LOTL) techniques, demonstrating that native pathways for movement and execution remain accessible to those who understand the underlying architectu

• ClickFix campaign uses fake macOS utilities lures to deliver infostealers

  ClickFix campaign uses fake macOS utilities lures to deliver infostealers Threat actors are targeting macOS users with fake utility fixes that trick them into running malicious Terminal commands. This campaign evades traditional defenses by stealing credentials, wallets, and sen

• "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages

  "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages A new npm supply chain attack self-branded "Mini Shai-Hulud" compromised four SAP-ecosystem packages on April 29, 2026. Snyk has live advisories. Here's the technical breakdown, IOCs, and w

• Introduction to COM usage by Windows threats

  Introduction to COM usage by Windows threats Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse. Those same qualities make it use

• STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus

  STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus Written by: Jordan Jones Introduction Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed a

All reports →

• Connector · intel_report_ingest3