Threat Intel Update
Cyber threats are intensifying across industries. A self-propagating npm malware campaign dubbed “SANDWORM_MODE” is stealing developer credentials and spreading worm-like through compromised packages. Separately, the Scattered LAPSUS$ Hunters collective is recruiting women to run vishing attacks on IT help desks, resetting passwords, bypassing MFA, and gaining network access.
On other fronts, threat actors are abusing ClawHub’s community trust through fake “troubleshooting” comments that install infostealer malware, while Chinese firms have allegedly conducted large-scale model distillation attacks against Claude via millions of automated interactions. U.S. education and healthcare sectors face an additional threat in Dohdoor, a stealthy DNS-over-HTTPS backdoor underscoring the growing risks to already-vulnerable industries.
Cybersecurity News
- Self-Replicating npm Malware Targets Developers – Nineteen typosquatting npm packages dubbed SANDWORM_MODE are stealing API keys, SSH keys, CI secrets, and crypto wallets while spreading worm-like through developer environments. The packages impersonate popular tools, including Claude Code, to blend into normal workflows, using HTTPS and DNS tunneling to evade detection. Developers should remove affected packages, rotate credentials, and audit their systems. Help Net Security
-
Cybercrime Group Pays Women to Run Vishing Scams – Scattered LAPSUS$ Hunters, a supergroup drawing from LAPSUS$, Scattered Spider, and ShinyHunters, is paying women $500–$1,000 per call to impersonate employees in scripted attacks on IT help desks. The goal: trigger password resets, bypass MFA, and gain network access. Once inside, the group escalates privileges, moves laterally, and has been linked to ransomware deployment. The Hacker News
-
Fake Troubleshooting Comments Spread Infostealer Malware on ClawHub – Threat actors are targeting ClawHub, the official repository for the OpenClaw AI agent, by posting fake troubleshooting comments on legitimate skills. Users who follow the instructions unknowingly install infostealer malware. The tactic exploits community trust rather than the packages themselves, making it harder to detect. Help Net Security
-
Chinese AI Firms Accused of Industrial-Scale Model Theft – Anthropic says three Chinese firms, DeepSeek, Moonshot AI, and MiniMax, extracted capabilities from Claude through over 16 million interactions across 24,000 fraudulent accounts. The firms used commercial proxies to mask the activity. Anthropic is responding with behavioral fingerprinting and stricter account verification to counter the attacks. The Hacker News
-
DNS-Hiding Backdoor Hits U.S. Education and Healthcare – A threat group tracked as UAT-10027 has been targeting U.S. schools and hospitals since at least December 2025 using a backdoor called Dohdoor. It tunnels command-and-control traffic through DNS-over-HTTPS to evade traditional security tools, and can silently deploy additional payloads like Cobalt Strike. Possible links to North Korean tactics have been noted. The Hacker News
Sign Up
To receive Threat Briefings by email.
