EvilBit Threat Digest - Supply Chains, Session Tokens, and a Page Cache That Doesn't Care About Containers

Copy Fail kernel LPE traverses containers, Microsoft AiTM hits 35,000 users, cPanel auth bypass on KEV, and three federal sentencings.

EvilBit Threat Digest - Supply Chains That Keep on Giving

Dual-RMM phishing hits 80+ orgs, cPanel and MOVEit auth bypasses under active exploit, APT28 keeps hijacking routers for M365 token theft.

EvilBit Threat Digest: Supply-Chain Mayhem and Insider Roulette

BlackCat insiders draw 4-year sentences, ShinyHunters AI-vishes ADT and Medtronic, and Mini Shai-Hulud worms its way into more npm packages.

EvilBit Threat Digest - Patch Tuesday leftovers and supply-chain hangovers

Patch volume was up this week. The louder stories came from attackers abusing trust at the edges of developer workflows, AI tooling, and government portals.

ZeroDay Field Notes - Preloaded Hardware, Fileless RMM Drops, and Supply-Chain Backdoors

Preloaded LunaSpy phones, in-memory ScreenConnect drops, npm typosquats stealing SSH keys, two Cisco ISE 9.9s. Disk is for chumps this week.

EvilBit Threat Digest - Patch Now or Pray Later: Nightmare-Eclipse, VPN Pivots, and Four Fresh Android Bankers

Nightmare-Eclipse Defender LPEs land in real intrusions, four Android bankers share 800+ targets, and Claude helps hijack BuddyBoss WordPress.

EvilBit Threat Digest - EvilBit Threat Digest: Copy, Paste, Regret

Developers lured through Slack, macOS users tricked into pasting malware, AI prompt injection in government, and NHS domains hijacked.

ZeroDay Field Notes - When the same names keep showing up

Kimsuky's credential playbook, Docker API miners, SystemBC's ransomware empire, RomCom zero-day chains, and why your extensions are someone else's red team.

EvilBit Threat Digest - Features, Until They're Evidence

Operational trust abused at machine speed: Axios, prt-scan, EvilTokens, Storm-1175, PolyShell, ComfyUI. Features, until they're evidence.

EvilBit Threat Digest - Trust, But Check the Package Manager

Supply chain compromises dominate the week: axios attribution lands, CI/CD blast radius widens, and phishing kits shrug off takedowns.

ZeroDay Field Notes - supply-chain backdoors surge

TeamPCP supply-chain attacks hit PyPI and npm, GlassWorm returns with unkillable Solana C2, and new fileless primitives ForsHops and FlipSwitch raise the stealth bar.

EvilBit Threat Digest - Gateways on Fire, Dependencies with Teeth

Active RCE in F5 BIG-IP APM, a nation-state npm supply-chain compromise, and macOS ClickFix stealer. April 1, but none of this is a joke.