[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGNg2ozgkFa7XLQkTNRU76s_OyeCjwVQ9AH_GHr4UPWc":3},{"article":4,"iocs":53,"watch_terms":60,"solutions":61,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"4d151d19-4cd2-4a93-9da2-bb00f31da160","ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories","threatsday-odysseus-rce-samsung-one-click-takeover-icloud-backdoor-fight-27-more-8347f0","Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job. This week runs on cheap leverage: exposed servers, recycled bugs, poisoned agent instructions, remote-access tools dressed as support software, and trusted defaults doing attackers a favor. Nothing here is especially mystical.","This week's ThreatsDay bulletin highlights multiple cybersecurity threats, including potential Chinese telecom infrastructure risks in the US facilitated by Salt Typhoon, SideWinder's new ClickOnce phishing attack chain delivering Rust backdoors, and a large-scale npm supply chain attack dubbed 'Flooding Dropper' with 846 malicious packages. Additionally, research reveals coding agents can execute code before the first prompt, posing a significant risk.","ThreatsDay bulletin covers Odysseus RCE, Samsung takeover, iCloud backdoor, China telco risks, SideWinder, npm attacks,","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fthreatsday-odysseus-rce-samsung-one.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhl0f74Tyvl6NQ4TAbPMIpgYWuHQN8THsYSQ77D9qmHuZdKsK2ZDrTLyWshLPV-UfSYW6Rbtfj866jP0X_D1QHmOFYIoEDZG90G3cy7JGFJrKsq0m7VeGqa0CCDygB9F3ttryPRQm-6MY50zIOsGFBdnwZZgAf31swGo5dOIa0noWuIoEk7rPrUkdfoddIj\u002Fs1600\u002Fthreatsd.jpg","2026-08-06T15:24:31+00:00","2026-08-06T16:00:56.682214+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Salt Typhoon","threat_actor",{"name":21,"type":19},"SideWinder",{"name":23,"type":24},"npm","technology",{"name":26,"type":27},"ClickOnce","product",{"name":29,"type":27},"Cloudflare Workers","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,57],{"type":50,"value":55,"context":56},"Rust-based backdoors","Delivered by SideWinder's new attack chain.",{"type":50,"value":58,"context":59},"JavaScript loader","First-stage payload in the Flooding Dropper campaign.",[26,29],{"controls":62,"vendors":148},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":93,"name":94,"problem":95,"products":96},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":122,"name":123,"problem":124,"products":125},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[126,132,140],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":128,"url":130,"description":131},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":167},"multi-vector-week-supply-chain-poisoning-phishing-backdoors-telecom-espionage","Multi-Vector Week: Supply Chain Poisoning, Phishing Backdoors & Telecom Espionage","This week's threat landscape illustrates how attackers are simultaneously exploiting trust across multiple vectors: software supply chains (846 malicious npm packages), social engineering via ClickOnce phishing delivering Rust backdoors, and suspected state-sponsored infiltration of telecom infrastructure. The npm 'Flooding Dropper' campaign is particularly alarming because developers inherently trust package registries, making malicious packages an efficient and scalable attack delivery mechanism. SideWinder's use of ClickOnce exploits demonstrates that legacy delivery mechanisms can still be weaponized effectively against insufficiently trained users. Compounding all of this, coding agents executing code prior to the first user prompt represent an emergent and poorly understood attack surface that organizations have not yet built defenses for. These converging threats underscore that no single control is sufficient — layered defenses across supply chain integrity, user awareness, and infrastructure hardening are all essential.",[154,155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST CSF ID.SC-4: Suppliers are monitored to confirm they are meeting their obligations","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","MITRE ATT&CK T1195.002: Supply Chain Compromise – Compromise Software Supply Chain","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1059: Command and Scripting Interpreter","SLSA Supply Chain Security Framework: Level 3+ Build Integrity","GDPR Article 32: Security of Processing (for organizations handling EU data via compromised supply chains)",{}]