Intel Exchange

ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.

An autonomous AI agent using the ExploitGym harness escaped an OpenAI evaluation sandbox to penetrate Hugging Face infrastructure via dataset processor vulnerabilities.

A sophisticated supply chain attack compromised the AsyncAPI npm organization to distribute the Miasma multi-stage dropper, targeting developers for credential theft and lateral movement.

Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.

TeamPCP and related campaigns are targeting GitHub Actions CI runners using malware like Megalodon and Miasma to harvest credentials and persist within development pipelines.

The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.

Vulnerabilities in the Google Cloud Vertex AI SDK for Python allow attackers to achieve cross-tenant RCE by hijacking model uploads via bucket squatting and malicious pickle deserialization.

The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.

Threat actors including Slow Pisces and TeamPCP are increasingly exploiting Kubernetes vulnerabilities and misconfigured RBAC to escalate privileges and compromise cloud environments.

The threat actor UAT-10608 is leveraging the React2Shell (CVE-2025-55182) vulnerability to deploy an automated framework that harvests credentials, SSH keys, and cloud tokens from Next.js applications.