Full Daily Digest

The attack vector centered on a GitHub workflow triggered by issue comments, which lacked author association checks and executed untrusted code from pull request forks. This allowed the attacker to mint npm trusted publishing tokens via OIDC, leveraging the workflow's id-token: write permission. The malicious versions, which drew 150,000 weekly downloads, included both preinstall script and native build step execution paths, rendering install script disabling ineffective for four versions. The attacker's cleanup efforts, including force-pushing branches to remove malicious commits, complicate forensic analysis. This incident underscores the need for rigorous workflow gating, including author association checks, avoiding untrusted ref checkouts in privileged contexts, and using frozen lockfiles in release jobs.

Mend (WhiteSource) Blog · 2026-08-29 · Incidents: Attackers exploited a GitHub workflow flaw to publish ten malicious versions of @7nohe/openapi-react-query-codegen, bypassing credential theft and trusted publishing safeguards.

The Hasbro breach underscores the vulnerability of employee data in targeted cyberattacks. The attack path likely involved network infiltration, leading to unauthorized access to sensitive personal information. While the exact method remains unclear, the breach’s timing aligns with a March cyberattack that forced system shutdowns, suggesting a possible ransomware or credential-based intrusion. The scope includes current and former employees, with financial and national ID data at risk. Mitigation efforts include third-party identity protection services, but proactive measures like enhanced endpoint detection, multi-factor authentication, and regular employee training are critical. Organizations must prioritize securing sensitive data and conducting post-incident forensic analyses to prevent recurrence.

SecurityWeek · 2026-08-29 · Incidents: Hasbro’s data breach exposed employee personal information, potentially linked to a March cyberattack, costing millions and affecting hundreds of individuals.

The TerminalFix campaign represents a significant evolution in the ClickFix malware family, shifting from simple infostealers to a multi-stage intrusion chain. Attackers exploit compromised websites to deliver a fake Cloudflare CAPTCHA overlay, tricking users into executing PowerShell commands. This initiates a complex attack sequence: DLL sideloading via a legitimate binary (LockScreenContentServer.exe) and a malicious DLL (dui70.dll), steganographic payload extraction from PNG images, and dual persistence mechanisms through Registry Run keys and scheduled tasks. The campaign conducts thorough Active Directory reconnaissance, including domain trust enumeration and admin discovery, before deploying a Python-based reverse-tunnel implant. This implant establishes an encrypted WebSocket channel, tunneling arbitrary TCP traffic to attacker-controlled infrastructure. Organizations must prioritize endpoint protection, monitor PowerShell activity, and block known malicious domains to mitigate this threat.

Microsoft Security Blog · 2026-08-29 · Incidents: TerminalFix campaign uses multi-stage attacks, including DLL sideloading and reverse-tunnel implants, to gain persistent network access through compromised hosts.