CloudSEK Updates

CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. The report maps the wider infrastructure, links parts of the activity to the PolinRider campaign, and details indicators, attack flow and defensive actions.

CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.

The first in CloudSEK's "Caught in 4K" series, where we pull ransomware operations out of the shadows and show exactly how they work. A misconfigured server opened a window straight into an Aurora ransomware operator's playbook: attacker tools, AI-assisted planning, and a look inside the actual negotiation panel where a victims and the operator settled on payment. In partnership with TRM Labs, we traced that payment on-chain, into a wider laundering network moving money across multiple victims. This is what ransomware looks like from the inside.

CloudSEK’s BRIDGEHEAD investigation exposes a 40-package npm typosquatting campaign that abuses WSL to reach Windows hosts and deploy a concealed Rust-based stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and exfiltration, making detection and takedown significantly harder.

CloudSEK uncovered a Chinese-speaking threat operator using autonomous AI coding agents to scale cyberattacks, including mass WordPress compromise, cryptocurrency wallet theft, credential harvesting and cryptojacking. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations more resilient to takedowns.

A Dependency Confusion Campaign Against Tinkoff Bank's Private Package Namespace

CloudSEK's research on the LiteLLM supply chain attack, the largest AI supply chain breach of 2026, names the organizations potentially exposed: 2,500+ companies and 434,000 CI/CD pipelines worldwide. The LiteLLM breach began with a compromised Trivy build and cascaded through PyPI into automated CI/CD pipelines, putting cloud credentials, source code repositories, Kubernetes environments and AI infrastructure at risk. Check whether your domain appears in the exposure dataset.

CloudSEK researchers uncovered an exposed server linked to a Russian-speaking initial access broker, revealing months of operations targeting internet-facing infrastructure across multiple sectors. The investigation connects credential theft, Active Directory compromise, and access sales to ransomware groups, while also uncovering surveillance activity targeting Ukrainian defence and aerospace organizations.

A tax-season malware campaign is impersonating the Income Tax Department, sending fake penalty notices over WhatsApp. Victims who tap "Download Documents" install malware capable of harvesting OTPs and banking credentials. The advisory also covers a wider ecosystem of refund SMS fraud, cloned e-Filing portals, and fake e-PAN emails targeting Indian taxpayers this season.