The tools you trust might be the ones attackers are betting on. |
Today’s roundup includes fake dev installs spreading infostealers, IT impersonation over Teams, a malicious npm package targeting developers, a high-stakes AI lawsuit, and a third-party breach exposing thousands of records.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Fake Claude Code Pages Spread Infostealer Malware |
Threat actors are cloning Claude Code installation pages to trick developers into running malware-laced commands. Researchers found attackers cloning Claude Code documentation and using sponsored search ads to trick users into running commands that install the Amatera infostealer. |
The campaigns remain active in the wild at the time of publication.
Avoid sponsored search links, verify install commands and URLs before running them, and use DNS filtering, EDR tools, and repository allow-listing to prevent malicious developer tool installations. |
Teams Impersonation Attack Deploys A0Backdoor |
Attackers are impersonating IT support on Microsoft Teams to trick employees into granting remote access that deploys A0Backdoor malware. Attackers used email bombing, Teams social engineering, and abused Quick Assist sessions to install fake Microsoft update packages that installed malware. The campaign is active in the wild. Restrict Quick Assist to authorized IT staff, enforce application allow-listing, and monitor for DLL sideloading, DNS tunneling, and suspicious remote-support sessions to detect and block Teams-based social engineering attacks. |
Malicious npm Package Deploys GhostClaw Malware |
A malicious npm package posing as a developer command-line tool is secretly installing credential-stealing malware and a remote access trojan on developer systems.
Researchers at JFrog Security found the @openclaw-ai/openclawai npm package posing as an installer while deploying GhostClaw malware that steals browser data, SSH keys, cloud credentials, crypto wallets, and developer tokens. The malicious package is still live in the wild at the time of publication.
Verify npm package authenticity before installing, restrict postinstall scripts, and use SCA and endpoint monitoring to detect malicious dependencies and suspicious developer workstation activity. |
|
|
Are your users protected from malvertising? |
|
|
Yesterday's Pulse Check Results |
Fraud Loss Debate: Who Pays After Phishing? |
|
|
Security Tools You Can Use |
|
|
Anthropic Sues Government Over AI Ban |
Anthropic has sued the Trump administration after the Pentagon labeled the company a “supply chain risk,” effectively blocking it from providing technology to defense agencies.
The dispute centers on Anthropic seeking stronger assurances that its Claude AI would not be used for autonomous weapons or mass surveillance, a stance that conflicted with defense priorities. |
This situation highlights how policy decisions can quickly reshape vendor risk and procurement strategies. Continuously reassess third-party AI vendor risk and contract dependencies so policy changes or government designations don’t unexpectedly disrupt critical technology supply chains. |
Ericsson Breach Exposes Data of 15,000+ |
A breach at a third-party service provider used by Ericsson’s U.S. subsidiary exposed sensitive personal data of more than 15,000 employees and customers.
Regulatory filings say attackers accessed vendor-hosted files, potentially exposing Social Security numbers, government IDs, financial data, and medical information. The company has begun notifying those impacted by the breach.
Strengthen third-party risk management by continuously assessing vendor security, enforcing zero-trust access controls, minimizing shared sensitive data, and monitoring vendor activity for signs of compromise. |
|
|
Is Your Dev Pipeline Letting Malware In? |
Open-source packages and third-party libraries are increasingly targeted by attackers who use malicious dependencies and compromised updates to quietly inject malware into development pipelines. |
How to strengthen your software supply chain security: |
-
Use DevSecOps tools and verify package authenticity to detect malicious or vulnerable dependencies before they enter development pipelines.
-
Restrict install scripts and pin dependency versions to prevent hidden malware execution and unauthorized updates during software installation.
- Monitor developer endpoints for suspicious activity and use vetted internal package mirrors to ensure dependencies come from trusted sources.
|
Software supply chain risks can spread quickly through shared dependencies, so strengthening verification, monitoring developer environments, and controlling how packages enter your pipeline helps reduce the chance of malicious code entering trusted software. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
