WIRED · Published 3 Apr
The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind
By Andy Greenberg, Matt Burgess
Excerpt
The scourge of software supply chain attacks—an increasingly common hacking technique that hides malicious code in a widely used legitimate program—can take many forms. Hackers can penetrate an update server to seed out their malware, or even break into the network where the software was developed to corrupt it at the source. Or, in the case of one particularly insidious software supply chain attacker known as Jia Tan, they can spend two years politely and enthusiastically volunteering to help.
Over the weekend, the cybersecurity and open source software community was shocked by the news that…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by WIRED on wired.com.
More from WIRED5
WIRED · Web page · Published 1 Feb
Inside Trickbot, Russia’s Notorious Ransomware Gang
Internal messages WIRED has viewed shed new light on the operators of one of the world's biggest botnets. Photograph: katleho Seisa/Getty Images When the phones and computer networks went down at Ridgeview Medical Center’s three hospitals on October 24, 2020,…
WIRED · Web page · Published 4 Jun
New ATM Malware Captures PINs and Cash -- Updated
Security researchers have found malware planted on ATMs in Eastern Europe that captures PINs and magnetic stripe data from the machine's memory and instructs the machines to spit out cash, eliminating the need for primitive skimming devices and advancing the…
WIRED · Web page · Published 15 Sep
Hack Brief: Emergency-Number Hack Bypasses Android Lock Screens
If you protect your Android phone with a password rather than an unlock pattern or PIN, you may want to keep it in your sight a little more carefully than usual. A new, dead-simple attack could allow anyone who gets their hands on it to bypass that password…
WIRED · Web page · Published 20 May
The Full Story of the Stunning RSA Hack Can Finally Be Told
Amid all the sleepless hours that Todd Leetham spent hunting ghosts inside his company’s network in early 2011, the experience that sticks with him most vividly all these years later is the moment he caught up with them. Or almost did. It was a spring…
On the same topics
JFrog · Web page · Published 22 Jun
From PostCSS Masquerading to Windows RAT
The package name is not random. The legitimate postcss-selector-parser package is widely used across the JavaScript build ecosystem, with npm reporting more than 150M weekly downloads. postcss-minify-selector-parser is not a classic one-character typo.…
hexastrike.com · Web page · Published 25 Mar
Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers
Overview of the Silver Fox AtlasCross campaign kill chain, from typosquatted lure domains through the triple-nested Setup Factory installer to fileless AtlasCross RAT deployment. Executive Summary A multi-stage remote access trojan campaign is actively…
The Hacker News · Web page · Published 19 Oct
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini,…
zenity.io · Web page · Published 6 Aug
Attackers Target Agents via The Skill Supply Chain
An active malware campaign used typosquatted skills, trojanized packages, and remote loaders to target users of popular AI tools. TL;DR We disrupted an active malware campaign targeting agents through typosquatted skills. It targets users of popular AI tools…