ChainDrop npm worm reads its C2 from an Ethereum contract - and scrapes CI runner memory for OIDC tokens. https://intel.threadlinqs.com/threat/TL-2026-3214 #ThreatIntel #DEVPOPPER #ShaiHulud #BeaverTail

"From fake interviews to malicious repositories: Disrupting Contagious Interview" published by Atlassian. #ContagiousInterview, #BeaverTail, #InvisibleFerret, #FamousChollima, #OtterCookie, #GolangGhost, #PylangGhost https://www.atlassian.com/blog/how-we-build/disrupting-contagious-interview

A stolen GitHub login turned npm's trusted-publishing pipeline into a self-deleting RAT delivery chain. https://intel.threadlinqs.com/threat/TL-2026-2605 #ThreatIntel #BeaverTail #OmniStealer #DEVPOPPER

npm's trusted-publishing pipeline just proved provenance can lie: DPRK slipped a loader past it. https://intel.threadlinqs.com/threat/TL-2026-2588 #ThreatIntel #GHAPPIER #PolinRider #BeaverTail

North Korean #WaterPlum hackers infected 30,000 devices worldwide

https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/

#NorthKorea #cybersecurity #BeaverTail #InvisibleFerret #OtterCookie #OtterCandy #SoatWaffle

North Korean hackers used fake AI and blockchain job offers in the WaterPlum campaign, infecting 30,000+ devices in 100 countries and stealing over $10.5M with malware to target crypto credentials. #NorthKorea #WaterPlum #BeaverTail

North Korea's WaterPlum poses as recruiters, then drops crypto-stealing malware via your own coding test. https://intel.threadlinqs.com/threat/TL-2026-2581 #ThreatIntel #BeaverTail #InvisibleFerret #OtterCookie

DPRK hackers pose as recruiters, then trick developers into running malware that drains crypto wallets. https://intel.threadlinqs.com/threat/TL-2026-2577 #ThreatIntel #BeaverTail #InvisibleFerret #OtterCookie

Nation-states now hide malware C2 inside blockchain transactions - infrastructure no one can take down. https://intel.threadlinqs.com/threat/TL-2026-2547 #ThreatIntel #JADESNOW #InvisibleFerret #BeaverTail