weekly

[SIGNALS WEEKLY] Tokens, Edges, and Exploits: Shifting Paths to Compromise

The token survived. npm packages, CI/CD runners, and edge boxes keep turning “contained” into “still owned.” The boring weakness became the breach path.

Wes

Wes

— 5 min read
Share
[SIGNALS WEEKLY] Tokens, Edges, and Exploits: Shifting Paths to Compromise
Elite adversary tradecraft, apparently sponsored by forgotten build secrets and one very tired edge box.

TL;DR

  • [Supply Chain / CI-CD] Attackers are compromising npm packages and CI/CD runners to steal tokens and secrets, enabling low-noise access to cloud and production environments without traditional malware.
  • [Vulnerabilities / Edge] Actively exploited bugs in Drupal, Trend Micro Apex One, Langflow, F5 BIG-IP, Confluence, and ASP.NET ViewState deserialization underline a recurring edge-to-internal pivot pattern and shared-secret misuse.
  • [E‑Crime / Phishing] Criminal ecosystems are scaling phishing-as-a-service for real-time OTP/session theft and losing some VPN infrastructure to law enforcement, but are likely to reconstitute anonymization and focus further on identity and session abuse.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe!

Like this? Forward this to a friend!

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Current Stories

TL;DR

  • [Supply Chain] Microsoft: compromised @antv npm maintainer pushed malicious versions; targeted GitHub Actions (Linux) to steal CI/CD creds and exfil secrets — who should care: GitHub Actions shops, npm-heavy front-end stacks, self-hosted runner operators.**

  • [Vulnerabilities] CISA KEV: active exploitation → urgent patching for Drupal Core SQLi (CVE-2026-9082), Trend Micro Apex One (on‑prem) traversal (CVE-2026-34926), and Langflow origin validation bug (CVE-2025-34291) — who should care: orgs running Drupal, Apex One on-prem, Langflow/LLM workflow tooling, and any internet-exposed app teams.**

  • [Cybercrime] Europol: “First VPN” disruption (33 servers seized; domains taken down) used by ransomware/data-theft actors; expect short-term infrastructure migration — who should care: ransomware-targeted sectors (health, manufacturing, local gov), threat hunting/IR teams tracking e-crime infra.**

  • [Intrusion Tradecraft] Microsoft: observed edge appliance (F5 BIG-IP) → internal app (Confluence) → identity/credential abuse chain — who should care: orgs with exposed edge appliances, Confluence admins, identity teams (AD/AAD/SSO).**

References

Emerging Stories

TL;DR

  • [Phishing] GTI: Chinese-language PhaaS is scaling real-time OTP/session theft, increasingly delivered via RCS/iMessage with automated localization — who should care: consumer-facing brands, helpdesks, finance/e-commerce, and mobile-security teams.

Read more