In today’s cybersecurity news…
The npm incident: nothing to fret about?
In Wednesday’s show we passed along the story that an attacker compromised a developer’s npm account through a phishing email and pushed malicious updates to 18 popular open-source packages. The code attempted to hijack cryptocurrency transactions, but quick detection and response limited the damage: malicious versions were live for about six hours, and losses totaled roughly $1,000. Researchers called it the largest npm attack to date in potential scope, but its actual impact appears to be minimal.
Cursor Autorun flaw lets repositories execute code without consent
A flaw in the Cursor extension allows repositories to automatically execute code when a folder is opened in Visual Studio Code, even without developer consent. The “autorun” feature can be exploited to steal API keys, alter files, or install persistent malware. With Workspace Trust off by default, opening a folder could compromise a developer’s machine. Experts warn this shows developer tools are now part of the attack surface.
Senator Wyden urges FTC to probe Microsoft over Ascension hack
US Senator Ron Wyden has urged the FTC to investigate Microsoft for “gross cybersecurity negligence” after the 2024 Ascension hospital ransomware attack affected 5.6 million patients. Wyden alleges the breach started after a contractor clicked a malicious Bing link and that Microsoft’s failure to disable the insecure RC4 encryption protocol contributed to the attack. Ascension reported $1.8 billion in operating losses and offered two years of identity protection to victims. Microsoft says RC4 use is minimal and plans to disable it by default in 2026.
Apple’s Memory Integrity Enforcement system thwarts spyware development
Apple launched Memory Integrity Enforcement (MIE) in its new iPhone 17, iPhone Air, and A19/A19 Pro chips, meant to block memory corruption exploits used by mercenary spyware. MIE combines hardware and OS checks via Enhanced Memory Tagging Extension (EMTE), verifying memory usage in real time to prevent unauthorized access. It doesn’t fully eliminate spyware risk, but Apple says it does make attacks much harder and more costly.
Huge thanks to our sponsor, Vanta
We know that real-time visibility is critical for security, but when it comes to our GRC programs…we rely on point-in-time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta.
Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done 5 times faster with AI.
Now that’s…a new way to GRC.
Get started at Vanta.com/headlines.
EggStreme malware breaches Philippine military systems
Bitdefender researcher Bogdan Zavadovschi said in a report shared with The Hacker News that Chinese state-sponsored APT group used a new fileless malware framework called EggStreme to compromise a Philippine military contractor. EggStreme operates entirely in memory, using DLL sideloading and a multi-stage payload to maintain persistence, steal data, and perform reconnaissance. Its core backdoor, EggStremeAgent, includes a keylogger and supports 58 commands for lateral movement, privilege escalation, and exfiltration. The malware also uses secondary implants and proxy tools to maintain access.
Salesloft Drift hack claims Tenable, Qualys
A supply chain attack on Salesloft’s Drift AI chat agent exposed OAuth tokens, affecting multiple companies including Tenable and Qualys. Attackers apparently accessed Salesloft’s GitHub account between March and June, then used the tokens to gain unauthorized access to Salesforce data containing customer contact information and support requests. The attacks, linked to the UNC6395 group, exploited weak controls and Tor exit nodes. Both affected companies said their services remained operational and disabled the Drift integration to contain the breach.
Jaguar Land Rover admits possible stolen data
Jaguar Land Rover has confirmed some data may have been compromised in a cyberattack that halted production at UK plants, affecting around 1,000 vehicles daily. JLR’s parent company Tata Motors hasn’t said whether the data involved customers, suppliers, or internal records. The attack was claimed by the Scattered Lapsus$ Hunters group and forced JLR to shut down IT networks while the National Cyber Security Centre assists with recovery.
(BBC)
ChillyHell macOS malware may have been live for 4 years
ChillyHell, a modular macOS backdoor, may have infected computers undetected for four years. This was first reported by Mandiant in 2023 and linked to the UNC4487 group. A developer-signed version passed Apple’s notarization in 2021 and was publicly hosted on Dropbox. Jamf Threat Labs researchers found that the malware persists via LaunchAgents, LaunchDaemons, or shell profile modifications, and evades detection using timestomping, multiple command-and-control protocols, and a modular design. It can download updates, brute-force passwords, exfiltrate data, and execute additional payloads. Apple has revoked the associated developer certificates.