Welcome to my weekly cybersecurity roundup! Here, I share updates on the projects I’m currently working on, along with the most insightful cybersecurity videos I watched, articles I found valuable, and podcasts I tuned into this week.

Featured Analysis

The Axios NPM Supply Chain Attack and its Attribution to State-Sponsored Actors

The recent alert from the FBI regarding Russian-backed threat actors targeting Signal users represents a significant escalation in the pursuit of high-value communications. Unlike traditional mass-phishing campaigns, these operations utilize highly tailored social engineering tactics designed to compromise the device’s underlying operating system rather than the Signal protocol itself. By leveraging zero-day vulnerabilities in mobile OS environments, attackers can bypass the robust end-to-end encryption that Signal provides, effectively capturing data at the endpoint before it is encrypted or after it has been decrypted for the user.

From a technical perspective, this shift highlights a critical pivot in nation-state tradecraft. When encryption becomes an insurmountable barrier, state actors refocus their resources on endpoint compromise and side-channel attacks. Security researchers have noted that these campaigns often involve the deployment of modular spyware capable of screen scraping, keylogging, and exfiltrating local SQLite databases where message history is stored. This approach renders the cryptographic strength of the messaging protocol secondary to the integrity of the host device’s kernel and application sandbox.

For CISOs and security administrators, this development underscores the urgent necessity of a “Zero Trust” approach to mobile device management. Relying solely on the inherent security of third-party applications is no longer sufficient when the hardware platform itself is the primary target. Organizations must prioritize rapid patch cycles for mobile operating systems and consider the implementation of Mobile Threat Defense (MTD) solutions. These tools provide the granular visibility required to detect anomalous process behavior or unauthorized escalation of privileges, indicators that are often the only signs of a sophisticated state-sponsored intrusion.

Projects

• TryHackMe – SOC L1 Alert Triage – Complete
• TryHackMe – Inside a Computer System – Complete
• TryHackMe – Computer Types – Complete
• TryHackMe – Client-Server Basics – Complete
• TryHackMe – Virtualisation Basics – In Progress

Videos

Articles

• Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account – The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency that delivers a trojan capable of targeting Windows, macOS, and Linux systems.
• Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069 – Google has formally attributed the supply chain compromise of the popular Axios npm package to a financially motivated North Korean threat activity cluster tracked as UNC1069.
• Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks – Report shows how industrialized credential theft underpins ransomware, SaaS breaches, and geopolitical attacks, shifting security focus from prevention to detecting misuse of legitimate access.
• Anthropic inadvertently leaks source code for Claude Code CLI tool – Anthropic, the flagship AI company, has inadvertently exposed the source code for its major CLI tool Claude Code. It has already been extracted with mirrors published on GitHub.
• Toy Giant Hasbro Hit by Cyberattack – The company is investigating the full scope of the incident, including whether any files have been compromised.
• Adversaries Exploit Vacant Homes to Intercept Mail in Hybrid Cybercrime – Fraud operations have expanded beyond traditional hacking techniques to include methods that exploit legitimate services and real-world infrastructure. By combining publicly available data, weak identity verification processes, and operational gaps, threat actors are building scalable fraud workflows that are both low-cost and difficult to detect.
• Man admits to locking thousands of Windows devices in extortion plot – A former core infrastructure engineer has pleaded guilty to locking Windows admins out of 254 servers as part of a failed extortion plot targeting his employer, an industrial company headquartered in Somerset County, New Jersey.