Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

thehackernews.com Nov 9, 2026

Hackers Compromise Ethersphere’s bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

Curated by Shubham · TechCapsules · Nov 9, 2026

AI-summarised brief · reviewed before publication

Attackers compromised Ethersphere’s continuous‑integration credentials and used the project’s own release pipeline to publish malicious versions of its Swarm storage tools—bee‑js 13.3.0 and Swarm Desktop 0.56.2. Both packages contained a post‑install loader that fetched additional code from a remote server, exfiltrated the node’s encrypted wallet key and plaintext password, and installed a persistent backdoor on Windows, macOS and Linux. The compromised Swarm Desktop update was offered via the built‑in auto‑updater to Windows x64 and Apple‑Silicon Macs within ten minutes of release; the bee‑js package was available on npm for about 75 minutes. Both releases were withdrawn after 8.5 hours and 65 downloads (bee‑js roughly ten), and a clean Swarm Desktop 0.56.3 was issued. No thefts have been reported, but any system that installed the malicious versions is considered fully compromised.

💡 Why It Matters

· The breach demonstrates how stolen CI credentials can weaponize trusted supply‑chain channels, turning everyday developer tools into silent credential‑stealers and remote‑access implants.

Capsules Cybersecurity

Read full article on thehackernews.com

Hackers Exploit Qubole’s Trusted AWS Access to Breach Customer Accounts and Steal…

Between October 14 and 26, attackers compromised AWS accounts belonging to multiple Qubole customers, stealing stored secrets and data, according to cloud‑security firm Wiz. The breach exploited the trust relationship that Qubole’s platform establishes with customers via an IAM role that permits Qubole’s AWS account (805246085872) to assume the role using an External ID. The attackers obtained credentials for that Qubole account—method undisclosed—and successfully issued AssumeRole requests from outside AWS, gaining access to unused but still trusted roles. Once inside, they harvested environment variables, Secrets Manager entries, SSM Parameter Store values, and copied data from any S3 buckets the roles could reach, sometimes downloading entire buckets. Wiz found no link to known state‑backed campaigns and noted that both Qubole and its owner Idera have not issued statements.

💡 The incident shows how lingering trust relationships and non‑secret External IDs can let attackers pivot across multiple clients, turning a single compromised service account into a multi‑tenant data breach vector.

thehackernews.com · Nov 9

CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high‑severity vulnerability in SonicWall SonicOS (CVE‑2026‑19868) to its Known Exploited Vulnerabilities catalog after reports of possible real‑world exploitation. The flaw allows users with alternate authentication credentials to bypass SAML‑enforced multi‑factor authentication on the SonicOS SSL‑VPN service. SonicWall confirmed the issue, urged customers to install the latest patch immediately, and highlighted additional high‑severity fixes for Federal Civilian Executive Branch agencies due by November 20, 2026.

💡 The vulnerability exposes a critical bypass of MFA, a cornerstone of modern identity security, potentially allowing attackers to gain unauthorized access to protected networks. Prompt patching is essential to prevent exploitation that could compromise sensitive federal data.

thehackernews.com · Nov 9

U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses

U.S. government agencies, including CISA, FBI, HHS, USDA, and DOT, issued a joint advisory warning that threat actors are targeting industrial refrigeration and cold‑chain monitoring systems worldwide. Attackers exploit unpatched or internet‑accessible controllers to force continuous heating or defrost cycles, risking fires, equipment damage, and massive inventory loss. The advisory urges operators to enforce strong authentication, patch systems, isolate OT devices, change default passwords, retire legacy hardware, and secure remote access. Recent incidents have affected supermarkets across Europe and the French Blood Establishment, raising temperatures to 50 °C and spoiling critical supplies.

💡 The attacks expose a critical vulnerability in the supply chain for temperature‑sensitive goods, threatening public health and food security. Prompt remediation is essential to prevent widespread spoilage and potential safety hazards.

thehackernews.com · Nov 9

Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

Bitter, a South Asian cyber‑espionage group, has deployed a new remote‑access trojan named PapRAT, featuring both C++ and Rust versions. The malware can execute commands, upload/download files, delete data, enumerate directories, capture screenshots, and run PowerShell scripts. It uses three infection chains: a living‑off‑the‑land script that harvests system data, a second script that retrieves logs from a separate domain, and a third that downloads an MSI installer to drop PapRAT and the older WmRAT. The campaign demonstrates refined, flexible access tactics.

💡 The use of multiple, script‑driven infection vectors shows how attackers can evade traditional signature‑based defenses, forcing organizations to scrutinize seemingly benign scripts and installers.

thehackernews.com · Nov 9

Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for…

Keplr wallet users who logged in with Google or Apple accounts suffered theft after a vulnerability in Web3Auth, the provider of the social‑login service, was exploited. The flaw gave the attacker access to private keys, allowing funds to be moved from compromised wallets. Web3Auth responded by using the same breach path to transfer assets from at‑risk accounts into designated recovery wallets before the thief could act, a process coordinated with Keplr. The rescue operation covered more than 44,000 wallets and moved over $6 million across Cosmos and Ethereum‑compatible chains. Wallets secured with recovery phrases or hardware devices were unaffected. Keplr has paused social‑login options, is investigating, and is working with Web3Auth to verify which accounts were impacted and to restore funds.

💡 The breach shows that convenient social‑login mechanisms can become a single point of failure for crypto custody, prompting a reassessment of authentication strategies in decentralized finance.

quantumcomputingreport.com · Nov 8

QNu Labs Introduces Corporate Quantum-Safe Training Supported by National Quantum Mission

Bengaluru‑based quantum cybersecurity firm QNu Labs has launched a 12‑hour corporate training program through its QNu Academy, aimed at preparing enterprise security teams for quantum‑safe migration. Backed by India’s National Quantum Mission, the three‑day curriculum targets CISOs, network architects and risk officers, teaching them to assess cryptographic vulnerabilities and plan transitions against threats such as “harvest now, decrypt later.” Modules cover quantum communications, Quantum Key Distribution, Quantum Random Number Generation, Post‑Quantum Cryptography, asset inventory management and algorithm selection, using case studies from QNu’s deployments in Indian defence and banking networks. Instruction is co‑led by QNu engineers and faculty from IITs, NITs and IISERs, with participants earning an NQM‑certified assessment. The program is offered as on‑site workshops for 15‑50 professionals and half‑day executive briefings for senior management.

💡 It equips Indian enterprises with practical skills to safeguard data before quantum computers become capable of breaking current encryption.