Originally reported by BleepingComputer, Cisco Talos, SentinelOne Labs, Malwarebytes Labs, SecureList (Kaspersky)
TL;DR
Supply chain attacks dominated this week with GlassWorm targeting hundreds of GitHub, npm, and VSCode repositories. Meanwhile, researchers unveiled new AI evasion techniques using font rendering, and Apple deployed emergency WebKit patches through their new background update system.
The GlassWorm supply chain campaign targeting 400+ repositories across major platforms represents a significant threat to software supply chains, while Apple's emergency WebKit fix suggests active exploitation concerns.
The GlassWorm supply chain campaign has returned with renewed intensity, targeting hundreds of packages across GitHub, npm, and VSCode/OpenVSX extension marketplaces. BleepingComputer reports the coordinated attack represents a significant escalation in supply chain threat tactics, potentially affecting downstream dependencies across the software development ecosystem.
The campaign's scope across multiple package repositories suggests sophisticated threat actors with deep understanding of modern development workflows.
Apple deployed its first Background Security Improvements update to address CVE-2026-20643, a WebKit vulnerability affecting iPhones, iPads, and Macs. The emergency patch delivery mechanism allows critical security fixes without requiring full OS upgrades, indicating Apple's assessment of active exploitation risk.
This new update channel represents a significant shift in Apple's patch delivery strategy for critical vulnerabilities.
Researchers demonstrated a novel attack technique using font rendering to hide malicious commands from AI assistants scanning webpage content. The method exploits visual presentation differences between how browsers render fonts and how AI models process the underlying HTML, creating blind spots in automated security scanning.
The technique highlights emerging challenges in securing AI-powered security tools against adversarial inputs.
Malwarebytes Labs reports 90% of survey respondents express distrust in AI systems handling their personal data, with many users actively reducing AI tool usage. The findings suggest significant adoption barriers for AI-powered security solutions requiring user data access.
SentinelOne Labs analysis reveals crypto thieves have generated approximately $9 billion through systematic exploitation of DeFi protocols, with operations ranging from the $1.5 billion Bybit incident to sophisticated drainers-as-a-service platforms. The research exposes mature criminal ecosystems built around cryptocurrency theft and laundering.
Threat actors deployed fake Pudgy World websites to harvest cryptocurrency wallet credentials from NFT enthusiasts. Malwarebytes Labs identifies the campaign as targeting fans of the popular Pudgy Penguins NFT collection through convincing replica sites designed to capture seed phrases and private keys.
Researchers uncovered a network exceeding 20,000 fraudulent e-commerce sites designed to harvest payment credentials and personal data. The scale suggests industrial-level fraud operations with significant infrastructure investment.
Cisco Talos released DispatchLogger, an open-source tool providing transparent instrumentation of late-bound IDispatch COM object interactions through proxy interception. The tool addresses visibility gaps in malware analysis workflows involving COM-based attacks.
The release enhances the defensive community's capability to analyze COM-based malware techniques.
Kaspersky's SOC team detailed a complex Horabot campaign targeting Mexican organizations, providing hunt methodologies and technical indicators. The analysis reveals sophisticated persistence mechanisms and evasion techniques specific to the regional threat landscape.
The European Union Council announced sanctions against three entities and two individuals involved in cyberattacks against critical infrastructure. The diplomatic response signals increased international coordination in addressing state-sponsored cyber threats.
Microsoft ceased automatic installation of the Microsoft 365 Copilot application following user feedback. The policy reversal addresses enterprise concerns about unauthorized software deployment in managed environments.
Originally reported by BleepingComputer, Cisco Talos, SentinelOne Labs, Malwarebytes Labs, SecureList (Kaspersky)