What looks normal may not be safe. |
From poisoned packages and dormant backdoors to stolen identities and large-scale fraud, today’s stories show how trust is being exploited across the stack — while new tools aim to restore it. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Malicious SAP npm Packages Steal Credentials |
Malicious code hidden in official SAP npm packages is quietly stealing developer and CI/CD secrets during routine installs. Aikido researchers found that CAP and Cloud MTA packages executed the payload silently via npm preinstall scripts, exposing credentials and using GitHub for C2 and propagation. |
SAP has not commented on the findings at the time of publication.
Remove compromised dependencies, enforce strict dependency and access controls, and continuously monitor and test your CI/CD pipeline for supply chain risks. |
Police Bust Ring Behind 610K Roblox Hacks |
Ukrainian authorities arrested three suspects tied to a large-scale campaign that hijacked and sold more than 610,000 Roblox accounts. The operation generated about $225,000 by targeting high-value accounts, using malware disguised as a game enhancer to steal credentials.
This shows how identity-based attacks can scale by exploiting user behavior and can potentially extend beyond gaming into enterprise environments. Enable MFA, avoid untrusted downloads, and continuously monitor accounts and devices to detect and respond to credential theft early. |
€50M Crypto Scam Network Stopped by Police |
European authorities dismantled a large cryptocurrency fraud network that stole over €50 million from victims worldwide.
The operation employed up to 450 individuals and mimicked a legitimate business, using fake investment platforms and retention agents to pressure victims into deposits and even install remote access tools. This highlights how organized fraud campaigns scale through trust-based manipulation, with tactics that can extend into enterprise environments.
Verify investment sources, enforce strong authentication and transaction controls, and continuously monitor for anomalies to reduce fraud risk. |
|
|
|
How are you currently using AI in your role? |
|
|
|
Yesterday's Pulse Check Results |
Could your self-managed GHES instance withstand a targeted attack? |
|
|
|
Security Tools You Can Use |
|
|
|
Cisco Releases Open-Source AI Model Provenance Tool |
Cisco has introduced an open-source Model Provenance Kit aimed at helping organizations verify the origins and integrity of AI models.
The tool addresses a growing gap in AI security as organizations rely on third-party models without clear visibility into their lineage or modifications, making provenance critical for trust and governance. |
It also highlights a key risk: models can inherit vulnerabilities and hidden dependencies through reuse and fine-tuning, increasing the need for better supply chain visibility.
Verify AI model lineage, enforce strong governance and access controls, and continuously monitor and test systems to reduce AI supply chain risk. |
WordPress Plugin Hides Backdoor for Years |
A WordPress plugin with over 70,000 installs was found to contain a hidden backdoor that remained dormant for years.
Attackers were able to push a version of the plug-in that injected a passive backdoor through a concealed self-update mechanism, which enabled content manipulation and potential arbitrary code execution. WordPress continues to investigate the issue.
Restrict plugins to trusted sources, disable external update mechanisms, enforce strict access control, and continuously verify file integrity to detect unauthorized changes early. |
|
|
|
How Secure Are Your AI Agents? |
As AI attacks become more common and agents scale across workflows, weak controls can expose systems to identity misuse, data leakage, and other unintended actions. |
- Enforce least privilege and strong identity controls for AI agents by applying zero trust principles, secure authentication, and scoped access to data, tools, and APIs.
-
Continuously monitor agent behavior and secure data pipelines with guardrails, input validation, and output filtering.
- Use an AI safety checklist and regularly test incident response scenarios to ensure readiness for agent compromise, drift, or malicious outputs.
|
These steps help reduce risk and ensure AI agents operate more securely as they scale across your environment. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
