Blogs and Articles

CloudSEK’s BRIDGEHEAD investigation exposes a 40-package npm typosquatting campaign that abuses WSL to reach Windows hosts and deploy a concealed Rust-based stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and exfiltration, making detection and takedown significantly harder.

CloudSEK uncovered a Chinese-speaking threat operator using autonomous AI coding agents to scale cyberattacks, including mass WordPress compromise, cryptocurrency wallet theft, credential harvesting and cryptojacking. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations more resilient to takedowns.

A Dependency Confusion Campaign Against Tinkoff Bank's Private Package Namespace

CloudSEK's research on the LiteLLM supply chain attack, the largest AI supply chain breach of 2026, names the organizations potentially exposed: 2,500+ companies and 434,000 CI/CD pipelines worldwide. The LiteLLM breach began with a compromised Trivy build and cascaded through PyPI into automated CI/CD pipelines, putting cloud credentials, source code repositories, Kubernetes environments and AI infrastructure at risk. Check whether your domain appears in the exposure dataset.

CloudSEK researchers uncovered an exposed server linked to a Russian-speaking initial access broker, revealing months of operations targeting internet-facing infrastructure across multiple sectors. The investigation connects credential theft, Active Directory compromise, and access sales to ransomware groups, while also uncovering surveillance activity targeting Ukrainian defence and aerospace organizations.

A tax-season malware campaign is impersonating the Income Tax Department, sending fake penalty notices over WhatsApp. Victims who tap "Download Documents" install malware capable of harvesting OTPs and banking credentials. The advisory also covers a wider ecosystem of refund SMS fraud, cloned e-Filing portals, and fake e-PAN emails targeting Indian taxpayers this season.

France’s underground cyber threat activity has surged more than fourfold in two years, driven largely by stolen credentials, infostealer logs, ransomware, and pro-Russian hacktivism. CloudSEK’s latest report reveals how government bodies, financial institutions, and smaller organisations are becoming increasingly exposed to a fast-growing cybercrime economy.

Tomorrowland 2026 sold out fast, and scammers moved faster. CloudSEK uncovered a dozen fake ticket shops and travel sites mimicking the festival, complete with countdown timers and fake "biometric checks." Some sites harvest identity data and payments; others quietly earn commissions. Read the full breakdown of how each scam works.

Uncover how an 18-day honeypot captured 15 million automated attacks targeting telephony ecosystems in the "Copy of SIP Honeypot Report.pdf". Download the full report to expose active VoIP fraud networks and access 277,632 recovered attacker passwords.