18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users

thehackernews.com Aug 3, 2026

18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users

Curated by Shubham · TechCapsules · Aug 3, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers have uncovered a coordinated supply‑chain attack that injects a cross‑platform remote‑access trojan into npm packages mimicking private Alibaba tools. The campaign uses a top‑layer lure package named “lib‑mtop,” which shares its name with an @ali‑scoped Alibaba module, and three subsequent versions released in March and April that add a loader fetching malicious JavaScript via curl. The same maintainer account, “ch4ce,” also published four additional packages—three empty wrappers and a legitimate‑looking JSON parser—each referencing innocuous dependencies that together form a hidden dependency tree. When installed in environments with access to the genuine @ali packages, the tree resolves and executes a loader that contacts a spoofed Alibaba domain, retrieves a sophisticated RAT, and injects code into enterprise apps such as DingTalk and Qoder. Chinese‑language comments and UTC+08:00 timestamps suggest a Chinese‑speaking threat actor targeting developers within Alibaba‑affiliated companies for industrial espionage.

💡 Why It Matters

· By exploiting trusted package names and Alibaba’s internal repository structure, the attack bypasses typical security checks and grants attackers persistent, multi‑OS control over high‑value development environments.

Capsules Cybersecurity

Read full article on thehackernews.com

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

The INC Ransomware group has become the primary threat exploiting SonicWall SMA 1000 VPN appliances’ flaws CVE‑2026‑15409 and CVE‑2026‑15410. Resecurity’s weekend report notes a surge in activity since early August 2026, with the gang claiming 885 victims, the latest on August 2. The vulnerabilities, patched by SonicWall in mid‑July, were weaponized as zero‑days to run arbitrary commands, steal high‑value credentials, session databases, and TOTP MFA seeds, enabling persistent access and lateral movement. Rapid7 links the campaign to a Python script (KNUCKLEBALL), an open‑source proxy (Suo5), and a custom Java web shell (ORANGETAIL), suggesting a single coordinated actor. Victims span private and government sectors across multiple continents, and many report deceptive “help” calls from a person named “Andrew” offering negotiations via info@helprans[.]com. Resecurity urges immediate patching, credential rotation, and thorough threat hunting.

💡 The attack demonstrates how quickly unpatched VPN flaws can be turned into a global ransomware supply chain, forcing organizations to reassess patch‑management and incident‑response readiness.

thehackernews.com · Aug 3

Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Researchers at Unit 42 have identified three post‑compromise techniques—Pass‑ta‑key, Silver Pass‑ta‑key and Golden Pass‑ta‑key—that allow malware running under a standard user account on Windows to authenticate to passkey‑protected services via Chrome’s Google Password Manager without any user interaction. The methods exploit how Chrome stores device keys, re‑enrolls devices, and how relying parties verify user presence. Pass‑ta‑key extracts a wrapped TPM‑derived device identity key and generates a valid assertion with the user‑verified flag unset; Silver Pass‑ta‑key forces a re‑enrollment window to inject an attacker‑controlled verification key; Golden Pass‑ta‑key reads the 32‑byte Security Domain Secret used to decrypt synced private keys. All attacks require initial malware access, do not break cryptography, and can yield reusable authentication tokens or decryption material. No CVEs have been assigned, and remediation status remains unclear.

💡 By bypassing user‑verification checks, these techniques let attackers silently hijack accounts that owners believed were protected by hardware‑backed passkeys, exposing a critical gap between credential storage and site‑level verification.

9to5mac.com · Aug 3

Report: Apple’s secrecy efforts partly undermined by lax work iCloud policy

Apple has sued two former employees, OpenAI and Jony Ive’s io Products, alleging trade‑secret theft, while a new report from The Information reveals that Apple’s practice of letting staff use personal Apple IDs for work iCloud accounts has left departing employees with lingering access to confidential files. The company’s onboarding process supplies devices and a paid iCloud account, encouraging users to merge personal and corporate IDs to avoid juggling multiple logins. Although Apple maintains a company‑managed iCloud folder that is removed on exit, many documents remain outside that folder and stay tied to the employee’s personal account. Former staff say this policy unintentionally preserved sensitive material after they left, complicating Apple’s claim that it took reasonable safeguards in court proceedings.

💡 The loophole shows how internal data‑management choices can erode a firm’s legal footing in trade‑secret disputes.

microsoft.com · Aug 3

Hackers target travelers through hotel and public Wi‑Fi networks

Microsoft Threat Intelligence has identified CaptiveCrunch, a campaign by Storm-2945, a sub-cluster of Midnight Blizzard, targeting travelers via compromised hotel and public Wi-Fi networks. Since early May 2026, the group has manipulated DNS and HTTP traffic on captive portals to redirect users to phishing sites mimicking Microsoft services. This adversary-in-the-middle operation abuses device code authentication flows in Microsoft Entra ID to steal credentials. Additionally, Storm-2945 delivers malware, including Windows remote access trojans and Android APKs, disguised as system updates. The attackers leverage AI to support these operations and exploit commonalities in captive portal management systems, suggesting widespread ecosystem access rather than isolated venue compromises. ReliaQuest confirms the activity affects hotels, conference centers, and shared venues globally. Microsoft shares these findings to help organizations detect and mitigate the threat, emphasizing the risk to corporate travelers. The investigation highlights Storm-2945’s technical overlap with Midnight Blizzard and their sophisticated use of ClickFix techniques to trick users into executing malicious payloads.

💡 The compromise of shared captive portal infrastructure allows attackers to intercept traffic from countless travelers simultaneously, bypassing traditional perimeter defenses. This systemic vulnerability exposes corporate data through a single point of failure in the hospitality ecosystem.

appleinsider.com · Aug 3

Confidential Apple files followed former employees to OpenAI through iCloud

Apple has sued OpenAI after discovering that several former employees continued to access confidential company files via their personal iCloud accounts. The lawsuit highlights that more than six ex‑employees reported that documents shared during their tenure remained available even after Apple revoked most corporate access. Notifications about file updates were still received, and the files included sensitive material such as product launch plans. The issue stemmed from Apple’s policy allowing employees to merge company‑funded iCloud storage with personal accounts.

💡 The case exposes a critical vulnerability in how tech giants manage data retention, raising questions about employee data security and corporate governance.

techcrunch.com · Aug 3

Horizon3 hits $2 billion valuation with $250M Series E as AI threats…

San Francisco‑based cybersecurity startup Horizon3 closed a $250 million Series E round, valuing the company at $2 billion, more than tripling its worth in just 14 months. The round was led by returning backers NightDragon and NEA, with new strategic investors including Singapore’s EDBI, defense contractor SAIC and Qualcomm. Horizon3’s NodeZero platform uses proprietary AI to continuously probe live networks without downtime, claiming to scan entire infrastructures rather than the typical 2‑3 % sampled annually. The firm reported roughly $100 million in R&D spend and approached $100 million in annual recurring revenue last year, posting 120 % year‑over‑year growth. The capital will fund global expansion into Amsterdam, Australia and Singapore and further development of its “AI Hacker” autonomous penetration‑testing technology to meet rising demand for real‑time cyber resilience.

💡 Enterprises now need nonstop, automated testing to keep pace with AI‑driven attacks that traditional, periodic assessments can’t contain.