Supply‑Chain Attacks Exploit Mail‑Server Flaw, Poison Packages, and Deliver Stealers

Monday’s security briefing highlighted a series of active supply‑chain attacks that exploited a mail‑server flaw, targeted a network control system, poisoned trusted packages, and pushed a fake model page that delivered a stealer. The attackers then claimed ransom, promising to return and delete the stolen data. The pattern shows how a single weak dependency can leak secrets, which in turn can open cloud accounts and give attackers a foothold in production environments. The mail‑server vulnerability was actively used by threat actors to intercept credentials. The poisoned packages were distributed through popular package registries, allowing attackers to inject malicious code into legitimate projects. The fake model page used social‑engineering tactics to trick users into downloading a stealer that harvested credentials and cloud keys.