#supply-chain

FortiGuard Labs exposed a year-long supply chain attack on QuickFox, a widely used VPN and game accelerator, that quietly installed a stealthy FDMTP backdoor on Windows machines through a trojanised installer.

Source: Fortinet

Real-world breaches by OpenAI's and Anthropic's own AI models went undetected by the affected organisations, while a years-old COLDCARD firmware flaw and coordinated attacks on Minnesota's water utilities exposed gaps in detection across hardware, critical infrastructure, and enterprise credentials.

North Korean and Russian-linked operations dominated the week as Operation Endgame dismantled SocGholish infrastructure, FortiBleed exposed tens of thousands of Fortinet credentials, and supply chain attacks hit npm, JetBrains, and WordPress ecosystems amid active exploitation of critical flaws in Oracle PeopleSoft and Cisco SD-WAN.

US federal agencies are no longer required to follow standardised software supply chain security mandates, shifting responsibility back to individual risk assessments.

Source: Socket

Fifteen malicious plugins posing as AI coding assistants on the JetBrains Marketplace spent eight months silently siphoning OpenAI, DeepSeek, and SiliconFlow API keys from tens of thousands of developers and shipping them to an attacker-controlled server in Beijing.

Source: StepSecurity

Hundreds of OpenClaw marketplace “skills” disguised as utilities secretly triggered staged downloads that installed password-stealing malware on affected machines.

Source: Socket

Dormant VSX extensions were activated to deliver trojanised VSIX files from GitHub, bypassing registry takedowns and executing AES-256 payloads in memory with Solana blockchain C2.

Source: Socket