ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories
ThreatsDay bulletin covers Odysseus RCE, Samsung takeover, iCloud backdoor, China telco risks, SideWinder, npm attacks,
This week's ThreatsDay bulletin highlights multiple cybersecurity threats, including potential Chinese telecom infrastructure risks in the US facilitated by Salt Typhoon, SideWinder's new ClickOnce phishing attack chain delivering Rust backdoors, and a large-scale npm supply chain attack dubbed 'Flooding Dropper' with 846 malicious packages. Additionally, research reveals coding agents can execute code before the first prompt, posing a significant risk.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ClickOnce?
Get an email when a new story names ClickOnce, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis week's threat landscape illustrates how attackers are simultaneously exploiting trust across multiple vectors: software supply chains (846 malicious npm packages), social engineering via ClickOnce phishing delivering Rust backdoors, and suspected state-sponsored infiltration of telecom infrastructure. The npm 'Flooding Dropper' campaign is particularly alarming because developers inherently trust package registries, making malicious packages an efficient and scalable attack delivery mechanism. SideWinder's use of ClickOnce exploits demonstrates that legacy delivery mechanisms can still be weaponized effectively against insufficiently trained users. Compounding all of this, coding agents executing code prior to the first user prompt represent an emergent and poorly understood attack surface that organizations have not yet built defenses for. These converging threats underscore that no single control is sufficient — layered defenses across supply chain integrity, user awareness, and infrastructure hardening are all essential.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Rust-based backdoors
- malware — JavaScript loader