Windows Defender Zero-Day Patched Out of Band

A supply chain attack (where an attacker compromises a trusted software component that developers rely on, infecting everything built with it downstream) hit the Injective Labs SDK this month, according to Bleeping Computer.

The Injective SDK is a development toolkit that programmers use to build cryptocurrency wallets, trading bots, and decentralised finance applications on the Injective blockchain. It gets downloaded roughly 50,000 times a week.

An attacker compromised a legitimate contributor's GitHub account on June 8 and used it to publish a malicious version of the package — version 1.20.21 — on npm (Node Package Manager, the central repository where developers download code libraries). The same poisoned version was pushed across 17 related packages.

The malware did not fire on installation. Instead, it waited until a developer called wallet functions, then silently captured mnemonic seed phrases (a 12–24 word backup code that grants full wallet access) and private keys. Those credentials were bundled together, encoded, and sent to an attacker-controlled server disguised as normal traffic to Injective's own infrastructure.

The malicious package was downloaded 310 times before being deprecated. Critically, it was deprecated rather than removed — the poisoned files are still accessible.

If you or your team use the Injective SDK: check your dependency versions immediately, transfer any cryptocurrency held in affected wallets to fresh wallets with new keys, and rotate all credentials in your build environment.

A newly discovered PhaaS (phishing-as-a-service, a criminal platform that rents out ready-made phishing infrastructure to other attackers) called Forg365 is selling turnkey Microsoft 365 account theft, according to Bleeping Computer.

What makes it notable is the integrated AI email generator, which lets operators craft convincing, personalised lures from the same dashboard they use to manage stolen accounts. Two attack methods are supported: AiTM (adversary-in-the-middle, where the platform acts as a hidden relay between the victim and Microsoft, capturing session cookies as they pass through) and device-code phishing, which tricks users into authorising an attacker's device through a legitimate Microsoft login flow.

A browser extension called ForgCookie silently refreshes stolen session cookies, giving attackers persistent access long after the initial compromise.

Action: In your Microsoft 365 admin settings, disable device-code authentication if your organisation does not require it. Review OAuth app grants for anything unfamiliar.

GitHub released npm 12 this week, and one change directly addresses the kind of supply chain attack described in today's breach story. According to The Hacker News, install scripts — small programs that run automatically when you download a code package — are now disabled by default.

Previously, a malicious package could execute code the moment a developer ran an install command. Now, those scripts must be explicitly approved first.

If you are a developer: upgrade to npm 12 now. Run npm approve-scripts --allow-scripts-pending to review any scripts in your current project before approving them. Think of it like previewing a contract before signing it, rather than having it auto-signed the moment it arrives.

Not a developer? Forward this to whoever manages your team's software builds. This one matters.

Get npm 12 at npmjs.com.

The European Commission has filed legal proceedings against Ireland, Spain, France, and the Netherlands for failing to implement the NIS2 Directive — the EU's baseline cybersecurity law for hospitals, energy networks, and public services — more than 20 months past the October 2024 deadline, according to The Record.

Daily financial penalties are being sought until each country fully transposes the law. For businesses operating in these countries: NIS2 compliance obligations apply to you regardless of where government proceedings stand. Do not wait for the fine to land before checking your incident reporting obligations.