OVHcloud confirmed that a compromised developer GitHub account was used to replace legitimate releases of its open-source ovhcloud-cli tool with malicious binaries designed to steal secrets from users' disks. The tainted versions were available for about 90 minutes and downloaded roughly 250 times before a user flagged suspicious activity, prompting OVHcloud to remove them within 30 minutes. CEO Octave Klaba urged affected users to update or delete the tool and rotate any exposed secrets.
darkreading.com
· 2026-10-21
A LiteLLM release published to PyPI as version 1.107.0 contained three hidden files that installed a credential-stealing script and a persistent backdoor on any machine that ran pip install, regardless of whether litellm was ever imported. The malicious code harvested SSH keys, cloud and CI/CD credentials, browser passwords and LLM API keys, sent them to an external domain, and set up an hourly process that fetched and executed remote code. PyPI has removed the release, and the official GitHub source and other recent versions were confirmed clean.
safedep.io
· 2026-10-21
OVHcloud confirmed that an attacker hijacked a developer's GitHub account and altered releases 0.11.0 through 0.15.0 of its open-source CLI tool to distribute information-stealing malware. CEO Octave Klaba said the tainted release went live at 14:47 on October 19 and was pulled by 16:21 after a customer flagged it, while versions 0.10.0 and 0.16.0 remained unaffected.
bleepingcomputer.com
· 2026-10-20
Rank Math says some downloads of its paid SEO plugin, version 3.0.123, between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware capable of implanting hidden backdoors once activated. The vendor pulled the affected files and issued a clean version, 3.0.124, while the free Rank Math SEO plugin used by over 4 million sites was not affected.
bleepingcomputer.com
· 2026-10-19
Attackers identified as UNC7017 compromised AOMEI's servers between April and July 2026, briefly altering configuration files used by AOMEI Backupper's promotional feature to distribute a new downloader called CROSSROAD and a backdoor called SHINYROAD, then restoring the files to cover their tracks. Researchers from ManageEngine's METAL team, Google's Threat Intelligence Group and Mandiant found affected organizations in the US, Australia, India, Singapore, Spain and Switzerland, spanning IT services, telecoms and higher education.
bleepingcomputer.com
· 2026-10-19
Ledger has directed resellers and distributors in Southeast Asia and Hong Kong to stop selling its hardware wallets and pull them from shelves while it investigates implanted chips found in devices sold by reseller CryptoBilis. The company's Donjon security team found a hidden microcontroller that reads recovery phrases and transmits them over LTE via an embedded eSIM, bypassing Ledger's normal integrity checks. Similar tampered units have also been reported from other sellers in Asia and Europe, including a Singapore airport retailer and MediaMarkt in Europe, which has already removed the product.
bleepingcomputer.com
· 2026-10-14
Ledger is overhauling its sales and anti-tampering policies following the 'Cryptobilis incident,' in which a physical hardware implant inserted somewhere in its supply chain led to $93 million in stolen crypto from user wallets. The breach, first detected October 9, affected wallets bought through CryptoBilis, an authorized reseller in Malaysia and Southeast Asia, prompting Ledger to halt all sales through that partner.
tomshardware.com
· 2026-10-14
Ledger confirmed that hardware implants planted in some Ledger Nano X wallets sold by Malaysian reseller CryptoBilis allowed attackers to steal roughly $102 million in crypto. Since then, a European buyer and other researchers have reported finding similar implants in Nano X, Flex and Stax devices purchased from a major German electronics chain, suggesting the tampering extends beyond the single reseller Ledger initially named.
zetter-zeroday.com
· 2026-10-14
Ledger has confirmed that a spy chip implant was responsible for a string of thefts from its crypto hardware wallets. The company has not yet detailed how many users or how much cryptocurrency was affected, or how the implant was introduced into affected devices.
yro.slashdot.org
· 2026-10-13
A version of the popular Zod validation library, 4.6.6, has surfaced containing obfuscated JavaScript that fetches remote instructions via blockchain RPC calls and downloads a secondary payload to execute. The code queries multiple Ethereum nodes, decodes the response into a domain, then retrieves a loader script that writes and runs an additional file in a temporary directory before cleaning up traces.
github.com
· 2026-10-12
Users of Ledger crypto wallets purchased through reseller CryptoBillis have reported drained accounts, with reports citing over $86 million stolen from hundreds of wallets. Photos shared on social media appear to show a hidden circuit board implanted under the wallet's screen that captures the seed passphrase and transmits it via an embedded SIM card. Ledger has asked CryptoBillis to pause all sales while it investigates, and says there is no evidence its own systems or directly purchased wallets were compromised.
theverge.com
· 2026-10-10
GitHub Actions repositories actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled in May after being compromised in the Mini Shai-Hulud supply-chain attack, were reinstated by their maintainer starting September 16 without removing the malicious code. Socket researchers found the release tags still pointed to the original tainted commit, meaning any workflow referencing those version tags resumed downloading and executing the malware payload through at least September 25.
bleepingcomputer.com
· 2026-09-26
GoKawiil