Tuesday 27 May 2025

Major Incidents or Breaches

• Over 70 malicious npm and VS Code packages were discovered, with at least 60 npm packages identified as harvesting sensitive data such as hostnames, IP addresses, DNS servers, and user directories. Exfiltration was conducted via Discord webhooks, with some packages also targeting cryptocurrency assets.
• The Russia-linked threat actor TAG-110 has been observed targeting Tajikistan government entities through a spear-phishing campaign. The attack chain leverages macro-enabled Word templates as the initial payload.

Newly Discovered Vulnerabilities

• Recent reporting references multiple critical CVEs and cloud breaches in the past week, though specific CVE identifiers and technical details were not provided in the available summaries.

Notable Threat Actor Activity

• TAG-110, a Russia-aligned group, is actively conducting spear-phishing operations against Tajikistan government targets using weaponized Word documents with malicious macros.

Trends, Tools, or Tactics of Interest

• The use of malicious npm and VS Code packages to exfiltrate system and user data, as well as cryptocurrency theft, continues to be a prevalent supply chain threat in the software development ecosystem.
• SVG steganography has been highlighted in recent security diaries, indicating ongoing interest in the use of image-based steganographic techniques for covert data transfer.
• AI-powered visual recognition is being integrated into consumer security cameras, as evidenced by the release of the Aqara Camera Hub G5 Pro.

Regulatory or Policy Developments Affecting the Security Industry

• A CISO-focused guide has been published outlining practical steps for continuous web privacy validation, emphasizing the importance of aligning privacy controls with real-world threats rather than mere compliance.