Supply Chain Security

Tool Hijacking: The 2024 Papers That Predicted Agent Attacks

Post author:Prabhu Kalyan Samal
Post published:September 8, 2026
Post category:AI & Agent Security Security Supply Chain Security

By November 2024, AI-agent security research had already documented the attack class that production incidents would later make infamous. InjecAgent (March 2024, ACL Findings) benchmarked 1,054 indirect-injection scenarios across 30 agents, finding ReAct-prompted GPT-4 attacked successfully roughly a quarter of the time. Breaking Agents (July 2024) demonstrated malfunction amplification through agentic loops. Together with 2023’s foundational indirect-prompt-injection work, they mapped how tools, descriptions, and fetched content become command channels. This survey walks the papers, the hijack taxonomy, and the controls that predate the incidents.

Sisense Breach: CI Credentials, AWS Keys and a CISA Advisory

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

On April 24, 2024, CISA and the FBI advised every Sisense customer to rotate credentials after attackers compromised the BI vendor’s development environment — and by week’s end, Sisense-issued AWS keys were circulating publicly. This piece reconstructs the five-day arc from detection to contained, explains why business-intelligence platforms are credential funnels that turn vendor CI/CD breaches into customer incidents, and extracts the third-party-risk doctrine the episode left behind for every embedded-analytics supply chain.

MOVEit Transfer Zero-Day: Cl0p’s Memorial Day Heist

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Security Supply Chain Security Web & API Security

CVE-2023-34362 in MOVEit Transfer let Cl0p deploy the LEMURLOOT web shell at scale over Memorial Day weekend — pure data extortion, no encryption, hundreds of downstream victims.

MOVEit’s Ledger: 2,700 Orgs, 93 Million People

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Security Supply Chain Security Web & API Security

Cl0p’s June 2023 listing waves turned the MOVEit breach into a running census — 2,700+ organizations and ~93M individuals per Emsisoft tallies. The economics of encryption-free extortion.

MSI’s BootGuard Key Leak: Hardware Trust on the Market

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Security Supply Chain Security

MSI’s ransomware extorted Intel BootGuard OEM signing keys onto underground markets — keys that certify firmware as bootable. Key ceremony lessons.

Namecheap/SendGrid Hijack: Phishing With Perfect DMARC

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Identity & Phishing Security Supply Chain Security

Phishers compromised a SendGrid supplier account and sent MetaMask-themed mail through Namecheap’s legitimate pipeline — SPF, DKIM, and DMARC all passed.

Twitch Leak: 125GB of Source Code and Payouts on 4chan

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Identity & Phishing Security Supply Chain Security

No malware, no zero-day — one exposed internal endpoint handed over Twitch’s entire codebase and three years of creator earnings.

The 3CX Supply-Chain Attack: When Signed Updates Turn Against You

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:AI & Agent Security Security Supply Chain Security

3CX’s signed desktop app shipped a trojan after its build pipeline fell to an upstream vendor compromise — the first documented double supply-chain attack.

GoDaddy’s Multi-Year cPanel Breach: 2.5 Years of Dwell

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

GoDaddy’s 2023 filing admitted intermittent intruder access since 2020, malware in cPanel servers, and email interception affecting ~6.95M customers.

git-credential Risks: When Helpers Leak What They Cache

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Security Supply Chain Security

Git’s January 2023 advisory flagged plaintext credential stores and verbose logs echoing 2FA tokens. Developer tooling is production security surface.

Squarespace Domain Hijackings: The 2024 GoDaddy Migration Aftermath

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

After Squarespace absorbed roughly 10 million domains from Google Domains in mid-2024, attackers discovered a seam: legacy Google-account login flows stopped being enforced, and formerly eNom-transferred .dev/.us domains could be taken over by re-registering then-unlinked accounts. From late June through July, crypto-draining hijacks of high-value domains — including Matomo founder trust abusing Squarespace lock states — left registry operators and site owners scrambling. This account traces the migration mechanics, the attack window, and the DNS tenure lessons.

Text4Shell: The 9.8 Severity Score That Wasn’t Log4Shell

Post author:Prabhu Kalyan Samal
Post published:September 4, 2026
Post category:Security Supply Chain Security

CVE-2022-42889 in Apache Commons Text scored CVSS 9.8 but needed apps to interpolate attacker strings — most never did. The reachability-triage lesson.