The software supply chain is under siege from “Shai Hulud v2,” a sophisticated malware campaign that has compromised 834 packages across the npm and Maven ecosystems.

This new wave specifically targets GitHub Actions workflows, exploiting pull_request_target triggers to inject malicious code into widely used libraries.

The attack has impacted major projects like PostHog, Zapier, and AsyncAPI, leveraging compromised automation tokens to infect downstream dependencies systematically.

The infection process relies on a stealthy two-stage loader initiated by a pre-install script named setupbun.js.

This script installs the Bun runtime to execute an obfuscated payload, bunenvironment.js, while suppressing standard output to avoid detection during build logs.

By pivoting through compromised CI pipelines, the malware gains privileged access to repository secrets, enabling it to modify source code, increment patch versions, and republish infected packages to public registries.

Socket.dev security analysts identified the malware’s unique persistence mechanism, noting its use of a beacon phrase, “Sha1-Hulud The Second Coming,” effectively searching GitHub to re-trigger infections.

This ensures that even if individual repositories are cleaned, the attackers can locate and re-compromise vulnerable endpoints.

Campaign’s impact

The campaign’s impact is extensive, exposing sensitive credentials from tens of thousands of repositories and marking a dangerous evolution in automated supply chain attacks.

Once entrenched in a CI environment, the malware executes a comprehensive credential harvesting routine. It captures all available environment variables, specifically targeting GITHUB_TOKEN, NPM_TOKEN, and AWS_ACCESS_KEY_ID, while simultaneously deploying a TruffleHog binary to scan the local filesystem for embedded secrets.

Unlike typical scrapers, this payload aggressively enumerates cloud infrastructure, cycling through every region in AWS, Google Cloud, and Azure to extract secrets from managed vaults.

All stolen data is obscured using three layers of Base64 encoding before being exfiltrated to a randomly generated GitHub repository created within the victim’s account.

Furthermore, the malware attempts privilege escalation on Linux runners by manipulating sudoers or executing Docker run –privileged commands to gain root access.

If no valid credentials are found to propagate the worm, the malware executes a destructive wiper function that deletes the files.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Shai Hulud v2 Exploits GitHub Actions Workflows as Attack Vector to Steal Secrets appeared first on Cyber Security News.

The “Korean Leaks” campaign has emerged as one of the most sophisticated supply chain attacks targeting South Korea’s financial sector in recent memory.

This operation combined the capabilities of the Qilin Ransomware-as-a-Service (RaaS) group with potential involvement from North Korean state-affiliated actors known as Moonstone Sleet.

The attackers leveraged a compromised Managed Service Provider (MSP) as their initial access vector, enabling them to breach multiple organizations through a single point of entry.

In September 2025, South Korea suddenly became the second most-targeted country for ransomware attacks, with 25 victims claimed in a single month.

This unusual spike was attributed exclusively to the Qilin ransomware group, which focused almost entirely on financial services firms, specifically asset management companies.

Of the 33 total victims, 28 are currently public, with documented cases confirming the theft of over 1 million files and 2 TB of data.

Bitdefender security researchers identified that Qilin operates like a gig economy, where main operators provide branding, software, and infrastructure while taking 15% to 20% of profits.

The actual hacking is executed by affiliates who earn the majority of the money. What makes this campaign particularly concerning is the early 2025 partnership between Qilin and Moonstone Sleet, a hacking group tied directly to North Korea, blurring the lines between cybercrime and state-sponsored espionage.

The attackers rolled out their campaign in three distinct publication waves. Wave 1 released 10 victims on September 14, 2025, framing the attacks as a public-service effort to expose systemic corruption.

Wave 2 escalated threats against the entire Korean stock market, while Wave 3 concluded with nine additional victims before returning to standard extortion messaging.

MSP Compromise as the Attack Vector

The root cause analysis revealed that the tight clustering of victims within a single financial niche pointed to a shared vulnerability connecting all targets.

Press reporting on September 23, 2025, confirmed that more than 20 asset management firms suffered breaches after their servers were hacked through a common domestic IT service provider.

This MSP compromise granted attackers simultaneous access to multiple client networks, explaining the speed and precision of the attack waves.

Defense recommendations include implementing multi-factor authentication, network segmentation, and adopting EDR/XDR/MDR solutions to minimize adversary dwell time.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Qilin RaaS Exposed 1 Million Files and 2 TB of Data Linked to Korean MSP Breach appeared first on Cyber Security News.

A major security threat has emerged targeting software developers worldwide. North Korean state-sponsored threat actors, operating under the “Contagious Interview” campaign, are systematically spreading malicious packages across npm, GitHub, and Vercel infrastructure to deliver OtterCookie malware.

This sophisticated multi-stage operation demonstrates how threat actors have adapted their tools to target modern JavaScript and Web3 development workflows.

Since October 10, 2025, researchers have uncovered at least 197 new malicious npm packages designed to trick developers into installing compromised code, with over 31,000 additional downloads recorded during this wave alone.

The attack chain works through a carefully coordinated supply chain approach. Threat actors create fake developer portfolios on GitHub, publish typosquatted packages on npm that impersonate legitimate libraries, and use Vercel hosting to stage the malware payloads.

When developers unknowingly install these malicious packages, a postinstall script automatically executes and reaches out to attacker-controlled endpoints to fetch and run the latest OtterCookie variant.

This seamless integration into standard development workflows makes the attack particularly dangerous, as it bypasses traditional security awareness since developers expect npm packages to execute code during installation.

Socket.dev security analysts noted and identified that the infrastructure behind this campaign reveals a well-orchestrated operation.

The researchers traced malicious packages like “tailwind-magic,” which impersonates the legitimate “tailwind-merge” library, to a threat actor-controlled GitHub account named “stardev0914” and a Vercel staging endpoint called “tetrismic.vercel.app.”

This account contained at least 18 repositories designed to serve as both delivery vehicles and convincing lures, with repositories themed around cryptocurrency projects including fake DEX front-ends and token sites.

At least five core malicious packages, including “node-tailwind,” “tailwind-node,” and “react-modal-select,” route through this infrastructure.

The malware architecture itself reflects sophisticated development. OtterCookie operates as a combined infostealer and remote access trojan with cross-platform capabilities spanning Windows, macOS, and Linux.

Once executed within a Node.js process, the malware performs initial environment checks to detect virtual machines and sandboxes, fingerprints the infected host, and then establishes bidirectional communication with command and control servers.

This detection-evasion approach ensures the malware only fully activates on legitimate developer machines rather than analyst environments where security researchers typically operate.

Infection and Persistence Mechanisms

The infection mechanism demonstrates meticulous engineering. The malicious npm packages use a postinstall script that executes when developers run npm install.

This script calls the threat actor endpoint at https://tetrismic.vercel.app/api/ipcheck using axios, which returns JavaScript code embedded in a JSON field named “model.”

The package then extracts this field and executes it with eval inside the victim’s Node.js process, granting the attackers full Node.js privileges and allowing arbitrary code execution.

The staging server continuously updates its main.js payload, enabling threat actors to rotate malware variants across multiple packages and customize responses per target.

Once deployed, OtterCookie establishes persistence through multiple mechanisms. On Windows systems, the malware creates scheduled tasks named “NodeUpdate” that run at logon with highest privileges, and adds registry entries under HKCU\Run\NodeHelper.

The actual payload spawns three asynchronous worker processes using child_process.spawn, each running as a detached Node.js process with stdio redirected to ignore and the windowsHide flag set true.

These processes then unref themselves, allowing them to continue running in the background after the initial loader exits.

The malware simultaneously performs system-wide keylogging using the GlobalKeyboardListener module, captures screenshots from all connected monitors every 5 seconds, exfiltrates clipboard contents, and recursively scans the filesystem for files matching patterns like “.env,” “metamask,” “phantom,” and “seed” to harvest cryptocurrency wallet data and credentials.

The comprehensive data harvesting capabilities extend to browser profiles. The malware specifically targets Chrome and Brave browsers on all three operating systems, accessing stored login credentials by querying the “Login Data” SQLite database found in each browser’s profile directory.

Additionally, it identifies and extracts data from at least 42 different cryptocurrency wallet browser extensions, including MetaMask, Phantom, Keplr, and dozens of others commonly used by Web3 developers.

All collected data flows through the command and control infrastructure at IP address 144.172.104.117, which handles both data collection and tasking, allowing threat actors to issue remote commands and maintain persistent interactive shell access.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post North Korean Hackers Exploiting npm, GitHub, and Vercel to Deliver OtterCookie Malware appeared first on Cyber Security News.