BuzzSec

Cybersecurity researchers have warned of malicious images pushed to the official "checkmarx/kics" Docker Hub repository. In an alert published today, software supply chain security company Socket revealed that unknown threat actors managed to have overwritten existing tags, including v2.1.20 and alpine, while also introducing a new v2.1.21 tag that does not correspond to an official release. The from The Hacker News https://thehackernews.com/2026/04/malicious-kics-docker-images-and-vs.html

Cybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads through stolen developer npm tokens. The supply chain worm has been detected by both Socket and StepSecurity, with the companies tracking the activity under the name CanisterSprawl owing to the use of an ICP canister to exfiltrate the stolen data from The Hacker News https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html

Threat actors are abusing agentic AI automation platforms to deliver malware and send phishing emails, according to researchers at Cisco Talos. The researchers observed attackers using n8n, a legitimate platform that automates workflows in web apps and services like Slack, GitHub, Google Sheets, and others. from Human Risk Management Blog https://blog.knowbe4.com/phishing-campaigns-abuse-ai-workflow-automation-platforms

A new phishing campaign is using WhatsApp messages to deliver malware, according to researchers at Microsoft. The attackers are attempting to trick users into installing malicious Visual Basic Script (VBS) files. “The campaign relies on a combination of social engineering and living-off-the-land techniques,” Microsoft says. “It uses renamed Windows utilities to blend into normal system activity, retrieves payloads from trusted cloud services such as AWS, Tencent Cloud, and Backblaze B2, and installs malicious Microsoft Installer (MSI) packages to maintain control of the system. By combining trusted platforms with legitimate tools, the threat actor reduces visibility and increases the likelihood of successful execution.” If a user falls for the phishing attack, the malicious VBS file creates a hidden folder on the infected system and creates renamed versions of legitimate Windows utilities to evade detection. Microsoft offers the following advice to help organizations thwart these ...

On January 31, 2026, researchers disclosed that Moltbook, a social network built for AI agents, had left its database wide open, exposing 35,000 email addresses and 1.5 million agent API tokens across 770,000 active agents. The more worrying part sat inside the private messages. Some of those conversations held plaintext third-party credentials, including OpenAI API keys shared between agents, from The Hacker News https://thehackernews.com/2026/04/toxic-combinations-when-cross-app.html

ICE has admitted that it uses spyware from the Israeli company Graphite. from Schneier on Security https://www.schneier.com/blog/archives/2026/04/ice-uses-graphite-spyware.html