OVHcloud CLI releases backdoored on GitHub to steal secrets
A hijacked contributor account swapped the binaries on OVHcloud CLI releases v0.11.0–v0.15.0 with secret-stealing builds. Clean release is v0.16.0. Rotate everything.
Newsroom
ROMULUS: a ClickFix delivery platform pushing LegionLoader
Forescout details ROMULUS, a ClickFix delivery platform that drops LegionLoader and a trojanized MSI, padding payloads to ~1GB to evade sandboxes. IOCs below.
Symantec: Swallowtail (APT28) hit NATO naval shipbuilder
Symantec ties intrusions at a NATO naval shipbuilder and other defense targets to Swallowtail (APT28), using the HOOKEDGE backdoor and a new reflective loader. Full IOCs below.
Zeabur shuts down after second breach hits 321,810 accounts
PaaS Zeabur will wind down by Dec 31 after a second breach in two months exposed 321,810 accounts and 3.2M env-var records via plaintext internal credentials.
Fake 'Apex' Web3 accelerator seeds npm malware, hijacks AI agents
Elastic ties a fake Web3 accelerator (REF8801) to malicious npm packages that drop stealers and reroute AI-agent traffic through an attacker-controlled MCP server.
Stolen login exposes California student records at ETS
A compromised credential let an intruder copy California student files from an ETS SFTP site between May and September 2026. Names, birth dates, addresses, and state IDs were exposed.
PeerStitch implant hid in FortiGate after FortiJump breach
Unit 42 details PeerStitch, a memory-resident FortiOS implant deployed in a telecom intrusion via CVE-2024-47575 and CVE-2025-61624. One FortiManager exposed 500+ managed firewalls.
GhostAction hides a credential stealer in a fake font file
A second-stage stealer disguised as fa-solid-400.woff2 was planted in 94 GitHub repos, harvesting AWS, npm, SSH, and Claude/Gemini keys via a VS Code tasks.json trigger.
OpenCode breach may have exposed users' AI provider keys
OpenCode says an intruder reached a legacy Console system and may have exposed OpenAI, Anthropic, and Google API keys for ~1.4% of Console users. Anthropic revoked affected Claude keys.