Update: Malicious PyPI and npm Packages Fuel Supply Chain Attacks
Zscaler researchers uncovered new supply chain threats involving malicious Python and JavaScript packages planted in popular repositories. On PyPI, attackers uploaded a package named termncolor, which relied on a dependency called colorinal to deliver a multi-stage infection. Once installed, the malware used DLL side-loading to execute a rogue DLL through a legitimate binary (vcpktsvr[.]exe), ultimately enabling persistence, system data collection, and remote code execution. Communications with the attacker’s command-and-control were disguised through Zulip, an open-source chat app, with over 90,000 messages linked to the actor’s organization since mid-July 2025. The attack did not stop at Windows; Linux systems were also targeted, with the libraries dropping a malicious shared object (terminate[.]so) to enable the same malicious features. Although downloads were limited, the campaign revealed a steady effort to weaponize open-source dependencies for covert infiltration. At the same time, npm repositories were hit with weaponized packages, including redux-ace and rtk-logger, which disguised themselves as developer tools but instead stole sensitive information from iCloud Keychain, browsers, and crypto wallets. These packages also executed Python scripts, logged keystrokes, took screenshots, monitored clipboard data, and exfiltrated information to attacker servers. Further activity tied to threat group MUT-1244 showed a pattern of luring targets with fake PoC code, kernel patches, or job assessment tasks. Compromises, including the recent poisoning of the widely used eslint-config-prettier package, highlighted the risks of automated dependency upgrades, where poisoned versions were pushed directly to npm without code reviews, exposing thousands of downstream projects. These incidents underscore that software supply chains remain a prime target for exploitation. Defenders should audit dependencies, avoid blindly relying on automated updates, monitor for suspicious network activity tied to development tools, and enforce strong code review and package verification processes before integrating third-party modules.
Update: NFC Relay Fraud Evolves into Global Ghost-Tapping Ecosystem
Chinese-speaking cybercriminals are launching a new wave of payment card fraud through “ghost-tapping,” an advanced form of NFC relay exploitation targeting mobile wallets including, Apple Pay and Google Pay. The scheme works by stealing card credentials through phishing or malware, then provisioning them into burner phones operated by recruited mules. Using the NFCGate tool, attackers can capture and modify NFC traffic, relaying tokenized data to emulate legitimate cards in real-time at point-of-sale terminals. This approach bypasses safeguards like OTPs, enabling unauthorized purchases without physical cards present. The infrastructure behind these attacks is supported by criminal syndicates in Southeast Asia, which supply preloaded devices, proprietary relay software, and mule networks to facilitate the fraud. The ecosystem operates as a structured supply chain. Criminal developers build the relay tools, syndicates manage mule recruitment, and mules perform in-person purchases of high-value goods, which can include gold, jewelry, and electronics, in countries across Southeast Asia. Items are smuggled and resold on platforms like Carousell, eBay, and even Telegram escrow markets, turning illicit profits into clean currency. Despite takedowns of platforms like Huione Guarantee in mid-2025, decentralized alternatives ensure the trade continues. With burner devices sold in bulk at around 90 USDT each and automation scripts exploiting banks’ digital wallet features, the business model is resilient and scalable. To counter this, banks must adopt stronger device risk assessments, replace SMS OTPs with app-based verification, and closely monitor abnormal transaction patterns. Consumers must remain vigilant against phishing, closely monitor their wallet activity, and promptly report any suspicious charges. Without tighter financial checks and broader law enforcement cooperation, ghost-tapping will continue to expand globally, with the potential to spread beyond Chinese-speaking syndicates as MaaS offerings become more accessible.
EncryptHub Exploits MSC EvilTwin to Deploy Fickle Stealer
The Russian group EncryptHub, also tracked as LARVA-208 and Water Gamayun, has been observed exploiting CVE-2025-26633, a vulnerability in Microsoft’s Management Console framework known as MSC EvilTwin, to deliver new malware. Despite the flaw being patched, campaigns observed in 2025 show the group combining social engineering with exploitation techniques to bypass defenses. In one sequence, attackers impersonated IT staff through Microsoft Teams to establish remote connections and deploy payloads using PowerShell. They used paired MSC files—one benign and one rogue—to exploit the flaw, causing the malicious file to execute when the harmless one was launched. This rogue file then pulled a PowerShell script from an external server, gathering system details, establishing persistence, and communicating with EncryptHub’s C2 to download further payloads. Their tactics also involved sideloading DLLs through legitimate installers to mask execution and evade detection. The group’s operations extend beyond technical exploitation, blending social engineering and abuse of trusted platforms to maintain persistence. They weaponized Brave Support, a legitimate web browser platform, by hosting malware packages through unauthorized access to an account with upload permissions. Other tools in their toolkit include a Go-based backdoor that leverages SOCKS5 tunneling, a loader called SilentCrystal, and fake conferencing services, including RivaTalk, designed to trick victims into downloading installers. Once inside, the malware exfiltrates system data, executes attacker-controlled PowerShell commands, and generates fake browser traffic to conceal its malicious activity. These attacks, active and evolving throughout 2025, highlight EncryptHub’s high tempo and resourcefulness. Defenders should prioritize applying patches promptly, monitor for suspicious PowerShell activity, validate Teams or conferencing requests before engaging, and reinforce user awareness training to reduce exposure to these persistent campaigns.
