Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages

TeamPCP’s Mini Shai-Hulud campaign used hijacked GitHub OIDC tokens to spread a credential-stealing worm through TanStack npm packages.

Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation

Google identified the first malicious AI use for a zero-day 2FA bypass in an open-source admin tool, accelerating threat actor operations.

Hackers Exploit Vercel GenAI to Mass-Produce Convincing Phishing Sites

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

BWH Hotels guests warned after reservation data checks out with cybercrooks

Customers urged to keep an eye out for phisherfolk

TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

TeamPCP compromised a Checkmarx Jenkins plugin in 2026, exposing supply chain security gaps and credential risks.

SailPoint Discloses GitHub Repository Hack

The incident occurred on April 20 and did not affect customer data in the company’s production and staging environments.

Hackers Use Weaponized JPEG File to Deploy Trojanized ScreenConnect Malware

Operation SilentCanvas hides malware in fake JPEG files, using PowerShell to silently infect Windows systems.

AI Firm Braintrust Prompts API Key Rotation After Data Breach

Hackers accessed one of the company’s AWS accounts and compromised AI provider secrets stored in Braintrust.

Over 500 Organizations Hit in Years-Long Phishing Campaign

Victims span across the aviation, critical infrastructure, energy, logistics, public administration, and technology sectors.

ClaudeBleed Vulnerability Lets Hackers Hijack Claude Chrome Extension to Steal Data

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread