North Korea Hit the AI Dev Toolkit

According to Bleeping Computer, Microsoft has confirmed that the North Korean hacking group Sapphire Sleet — also known as BlueNoroff — carried out a supply chain attack (where attackers tamper with software before it reaches the end user, rather than hacking users directly) against Mastra AI, a framework developers use to build AI-powered applications.

The attackers first compromised a legitimate npm account — npm being the package registry where JavaScript developers download code libraries. With that account's publishing rights in hand, they pushed malicious updates to more than 140 packages. Each poisoned package quietly installed a fake dependency called easy-day-js, designed to look like the real and widely-trusted dayjs date library. It is the software equivalent of swapping out a jar of coffee for one laced with something worse, then putting it back on the shelf.

Once a developer installed any of the affected packages, the malicious code ran automatically during setup, disabled security certificate checks, contacted attacker-controlled servers, and dropped a second-stage payload. That payload ran invisibly in the background and went hunting: browser history, installed apps, running processes, and 166 cryptocurrency wallet browser extensions including MetaMask, Coinbase Wallet, and Binance Wallet.

The malware targeted Windows, macOS, and Linux. On compromised machines, Microsoft also observed a PowerShell backdoor and a malicious Windows service granting the highest level of system access. Microsoft attributes this attack to Sapphire Sleet with high confidence, noting the same group carried out a separate npm supply chain attack against the Axios HTTP client in April 2026.

What to do: If you work with JavaScript or AI development tools, audit your recent npm installs for any @mastra scoped packages. Rotate any API keys, authentication tokens, or credentials stored on affected machines. Check whether Microsoft Defender has had any exclusions added that you did not authorise.

The Mastra AI supply chain attack is worth examining as an emerging threat pattern, not just a one-off breach. Sapphire Sleet did not hack developers directly. Instead, according to Bleeping Computer, they compromised a single package maintainer account and used it to push malicious code into 140+ packages that developers were already trusting and installing automatically.

AI development frameworks are a particularly attractive target here. Developers building AI tools frequently install large numbers of third-party packages, often in automated pipelines that run without human review at each step. The attackers exploited exactly that trust. Once inside a developer's machine, they went specifically for cryptocurrency wallets and API keys — a financially motivated choice consistent with Sapphire Sleet's broader campaign history.

What to do: If your team uses npm packages in AI or any other development work, consider enabling package integrity checks and auditing install logs for unexpected post-install script execution.

What Gravity SMTP is: A WordPress plugin installed on roughly 100,000 websites that manages transactional email sending by connecting to third-party services like Amazon SES, Google, and Mailjet.

What it is: The plugin exposes a REST API endpoint (a URL on your website that accepts requests and returns data) that has no authentication guard. Its permission_callback (the security check that decides who can access this endpoint) unconditionally returns true, meaning anyone on the internet can query it without logging in.

Who's at risk: Any website running Gravity SMTP below version 2.1.5 with active third-party email integrations configured. No login required to exploit this.

CVSS: 5.3 (Medium — patch in your next update cycle, sooner if you have live API keys configured).

Root cause: The register_connector_data() method (the function that loads and packages the plugin's internal configuration) triggers when a specific query string is appended to the endpoint URL. Because the access check was never properly implemented, the server happily assembles and returns a detailed system report to anyone who asks. The exposed data includes API keys, OAuth tokens, your WordPress version, active plugins, database structure, and web server details — essentially a roadmap for a follow-on attack. Imagine accidentally leaving your filing cabinet open with a printed directory of every key in the building sitting on top.

Recommended actions:

1. Update Gravity SMTP to version 2.1.5 or later immediately via your WordPress dashboard.
2. If you were running a vulnerable version with email integrations configured, treat your API keys as compromised — rotate credentials for Amazon SES, Google, Mailjet, Resend, and Zoho.
3. Review your server access logs for requests to /wp-json/gravitysmtp/v1/tests/mock-data — Wordfence has blocked over 17 million exploit attempts to date, with activity spiking around June 6 and seeing peaks of over 4 million requests in a single day.

A new ransomware operation called Prinz Eugen is quietly active, and it does not leave a ransom note — so you might not know you've been hit until your files are already encrypted and gone. The group gets in through stolen RDP credentials (remote desktop login details), then manually runs their payload and sets up a backdoor admin account for persistence.

Malwarebytes' enterprise arm ThreatDown has published a full analysis including indicators of compromise — specific file names, IP addresses, and behavioural patterns you or your IT team can use to check whether this threat has touched your environment. You can find the indicators of compromise list in ThreatDown's full report.

What to do right now: Make sure RDP (Remote Desktop Protocol — remote access to your computer) is either disabled or protected by multi-factor authentication. Unexpected new administrator accounts are a red flag worth investigating immediately.

At a G7 summit in France, French President Emmanuel Macron urged wealthy democracies to cooperate on regulating advanced AI systems, warning against any single nation keeping frontier AI models off-limits to allies. OpenAI CEO Sam Altman echoed the call, saying AI safety decisions should not rest with tech companies alone and that an international forum is needed to establish testing standards and risk analysis, according to SecurityWeek. The backdrop: the Trump administration's directive restricting foreign access to Anthropic's latest models forced them offline in Europe.

For everyday users, these discussions matter — who regulates AI determines what safeguards exist on the tools you use daily. No binding agreements were reached.