Afternoon Review in IT Security — May 12, 2026

Today's threat landscape continues to evolve with sophisticated supply-chain attacks, critical enterprise vulnerabilities, and shifting ransomware tactics dominating the security conversation. Organizations across multiple sectors face renewed pressure to patch critical systems and strengthen their defenses against increasingly coordinated threat campaigns.

Operation HumanitarianBait Uses Fake Aid Documents to Deploy Python Spyware

A new threat campaign designated Operation HumanitarianBait has emerged, leveraging deceptive humanitarian aid documents to distribute Python-based spyware to Russian-speaking victims. The operation employs GitHub-hosted payloads to deliver malicious code, demonstrating the attackers' sophistication in utilizing legitimate platforms for malicious purposes. Source: Hackread

The campaign has been linked to multiple indicators of compromise, including the malware variant module.pyw and associated infrastructure at IP address 159.198.41.140. Security researchers have documented a SHA256 hash of 8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79 associated with the malicious payloads, enabling organizations to detect and block related threats.

Shai Hulud Attack Ships Signed Malicious TanStack, Mistral npm Packages

The Shai Hulud supply-chain campaign has compromised hundreds of packages across npm and PyPI repositories, distributing credential-stealing malware specifically targeting developers. The attackers have successfully signed malicious packages impersonating legitimate projects including TanStack and Mistral, establishing a significant foothold within the open-source ecosystem. Source: Bleeping Computer

Infrastructure associated with the campaign includes command and control domains such as api.masscan.cloud and git-tanstack.com, which are being used to exfiltrate stolen credentials from compromised developer environments. This campaign represents a critical threat to the software supply chain, as affected developers may unknowingly incorporate malicious dependencies into their projects.

SAP Fixes Critical Vulnerabilities in Commerce Cloud and S/4HANA

SAP has released its May 2026 security updates addressing 15 vulnerabilities across multiple enterprise products, with particular focus on two critical flaws affecting Commerce Cloud and the S/4HANA ERP suite. These critical vulnerabilities pose significant risk to organizations relying on SAP infrastructure for e-commerce and enterprise resource planning operations. Source: Bleeping Computer

The identified critical vulnerabilities are tracked as CVE-2026-34260 and CVE-2026-34263, and organizations operating these enterprise-grade platforms should prioritize patching efforts immediately to prevent potential exploitation by threat actors.

State of Ransomware in 2026

Kaspersky researchers have released their analysis of ransomware trends for 2026, identifying several significant shifts in attacker behavior and capabilities. The research highlights the rise of EDR killers—tools specifically designed to disable endpoint detection and response solutions—as a primary concern for defenders. Source: Securelist

A notable trend documented in the research is the transition from data encryption-focused attacks to data exfiltration and extortion models, where attackers prioritize stealing sensitive information over rendering systems inoperable. Notable threat groups including ShinyHunters continue to evolve their tactics, and malware families such as PE32 variants demonstrate the ongoing sophistication of the ransomware threat landscape.

As May 12 concludes, organizations are urged to prioritize patching critical SAP vulnerabilities, audit their open-source dependencies for compromised packages, and strengthen their defenses against both supply-chain threats and evolving ransomware campaigns.