Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

mend

Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave

May 12, 2026 By Tom Abai In Mend
The Mini Shai-Hulud supply chain campaign has resurfaced with its largest wave yet. Over a 48-hour window on May 11-12, 2026, attackers compromised 172 unique packages across 403 malicious versions on npm and PyPI, including high-profile scopes like @tanstack, @uipath, @mistralai, and @opensearch-project.
Read Post
aikido

Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack

May 12, 2026 By Raphael Silva In Aikido
Mini Shai-Hulud is back. Like I said before, we were yet to see the full scale of the attack. The npm campaign we covered in April, when it targeted SAP packages, has now turned into a much larger compromise. Our Malware Team detected 373 malicious package-version entries across 169 npm package names. The basic goal is still the same: steal credentials from developer machines and CI/CD runners, then use those credentials to reach more packages. What changed is the scale and the release path.
Read Post
safeaeon

How to Prevent Ransomware on Networks: Proven Strategies for Protection

May 11, 2026 By SafeAeon Inc. In SafeAeon
Organizations around the world are increasingly vulnerable to ransomware attacks, which have caused over $57 billion in damages globally by 2025, according to a report by Cybersecurity Ventures. These cyberattacks can shut down entire networks, disrupt services, and inflict severe financial and reputational damage. Knowing how to prevent ransomware on networks is essential to staying protected against these threats.
Read Post
sophos

Ransomware: AI changes the writer. It doesn't change the math.

May 11, 2026 By Mark Loman In Sophos
Ransomware: AI changes the writer. It doesn't change the math. Why most endpoint protection still treats ransomware as just another piece of malware, and what changes when you watch the data instead of the attacker. In 2013, CryptoLocker introduced the modern ransomware playbook. It also introduced something most of the industry has still not come to terms with: remote encryption.
Read Post
bitsight

The Symbiosis of Residential Proxy Services and Malware Ecosystems

May 7, 2026 By Valter Santos In BitSight
Residential proxy services, also called RESIP, present a persistent operational hurdle for tracking and attributing malicious network activity, as they allow threat actors to mask their true origins behind seemingly benign, geographically diverse IP addresses. While often marketed for legitimate use cases, these networks are aggressively leveraged for fraud, credential abuse, and perimeter evasion.
Read Post
sophos

Donuts and Beagles: Fake Claude site spreads backdoor

May 7, 2026 By Chaitanya Ghorpade In Sophos
A malicious imitation of Anthropic’s Claude site leads to DLL sideloading – and a backdoor As we reported on social media recently, Sophos X-Ops has been investigating reports of a fake Claude AI website distributing malware. Like other researchers, we thought this might be a PlugX-like campaign, given that the attack chain shares several characteristics with observed PlugX attacks.
Read Post

Your Backups Know More Than You Think

May 5, 2026 By Rubrik In Rubrik
You may not be aware of how valuable your backups are: they can contain extremely valuable information that leaves a record of what your other security tools may have missed. This is just one of the many interesting tidbits Kyle Fiehler provided on his recent episode of Data Security Decoded. Kyle also explains how threat actors exploit backup blind spots, why identity and recovery are now prime attack surfaces, and how security leaders can rethink MTTR.
View Video

The Terrorist Designation: A New Red Line for Ransomware with Cynthia Kaiser

May 5, 2026 By Rubrik In Rubrik
In this episode, host ⁠Caleb Tolin⁠ explores the battlefield of enterprise defense, which has moved from simple data theft to ultra heinous crimes that put patient outcomes at risk. Guest ⁠Cynthia Kaiser⁠ shares Battlefield Stories from her time at the FBI and her current work as SVP of the Ransomware Research Center at ⁠Halcyon⁠ (@halcyonsecurity ) illustrating how the industrialization of cybercrime has reached a tipping point. They dive into the alarming reality of modern dwell times, specifically looking at how groups like Akira move from initial access to full encryption in as little as one hour.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.