Miasma compromises Red Hat npm packages through a trusted publishing workflow
Wiz and JFrog describe malicious Red Hat npm releases that steal developer secrets, abuse publishing identities and retain valid provenance despite compromised workflows.
Tags /
#Cloud Security
3 reports
BlackFile and UNC6671: voice phishing, stolen cloud sessions and data extortion
Google tracks BlackFile as UNC6671, a voice-phishing extortion operation targeting cloud identities. FileAccessed events and unauthorised MFA enrolment are important investigation leads.
PCPJack targets cloud credentials: tracing propagation and recovering exposed services
SentinelLABS describes a cloud worm that removes TeamPCP artefacts, steals credentials and spreads through exposed services. Recovery must follow identities and connected workloads.