Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444

Wiz Research found Miasma, a supply-chain attack on @redhat-cloud-services npm: 32+ tampered releases (~80k weekly downloads) carried a Shai-Hulud-derived payload targeting GCP and Azure identities.

Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.

Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.

Hunt.io resurfaces a suspected TA444/BlueNoroff cluster: a server hosting a fake 'JustJoin' macOS app landing page, plus two IPs sharing SSH keys pointing to coordinated DPRK-linked infrastructure.

On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:

Go malware has appeared in two Terraform providers and two Go modules — the first observed abuse of Terraform providers. The Graphalgo Go port hides a hash-gated trigger with blockchain and Slack C2.