Risky Bulletin: Arch Linux supply chain attack spreads to 1,900+ AUR packages

This newsletter is brought to you by Ent AI. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

More than 1,900 Arch Linux packages have been hijacked over the weekend as part of a massive supply chain attack designed to infect users with a rootkit and a credentials harvester.

The attacker(s) targeted Arch Linux packages hosted on the AUR portal, an unofficial repository of Arch packages created by the community. The portal hosts a massive 100,000 entries, but almost a tenth have been abandoned by their maintainers in what AUR calls "orphaned packages."

The attack exploited an AUR mechanism that allowed the hacker to "adopt" the abandoned packages and become a maintainer.

According to reports, the attacker added the package installation procedure to add a malicious npm package that then downloaded and installed a rootkit and infostealer.

The initial wave hijacked 400 packages, and then expanded to 1,500, and was (at the time of writing), close to hitting 2,000 packages. See an actively maintained list of the hijacked packages here.

The hacker was aware of efforts to stop the attack and has been modifying the installation procedure, replacing the npm package with a Bun script to bypass detections.

The attempts to hijack packages are still ongoing.

For now, numbers are being computed and it's still unclear how many users downloaded hijacked AUR packages during the attack window.

While having a rootkit on your Linux machine is pretty bad as it is, affected users should immediately start changing passwords and tokens.

An analysis of the malware deployed in the attack shows the infostealer can collect credentials from browsers and Electron apps, as well as local developer-related secrets and access keys. After you've done all of that, then you can remove the rootkit and other persistence mechanisms.

Researchers have yet to attribute the attack.

Post by @ifin@infosec.exchange

View on Mastodon

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, James, and special guest co-host Chris Wade, the founder of Corellium turned Cellebrite CTO, at the helm!

Breaches, hacks, and security incidents

Maine disables data breach portal: The Maine Office of the Attorney General has taken down the state's data breach reporting portal. Unknown individuals abused the portal last week to file fake data breach notices on behalf of online game VRChat and messaging platform Discord. The breach notifications were accepted on the portal with no other verification. Maine officials said they're reworking breach submission procedures to prevent future abuse. [Maine OAG // BleepingComputer]

Awesome Motive supply chain attack: More than 1.2 million websites have been backdoored following a security incident at Awesome Motive, a major developer of WordPress plugins. Malicious code was added to the legitimate JavaScript files of three of the company's plugins—OptinMonster, TrustPulse, and PushEngage. The code waits until an admin logs in, creates its own admin account, and then installs a self-hiding backdoor plugin to maintain access. No malicious code has been seen in Awesome Motive's other plugins, some of which are installed on tens of millions of sites. [Sansec]

New batch of ShinyHunters victims: The ShinyHunters hacking group has listed a new batch of victims on its dark web leak site. The group is currently trying to extort the Council of Europe, fashion giants Ralph Lauren and JCPenney, as well as Nexstar, the US' largest TV broadcaster. Most of the companies listed on ShinyHunters' leak page have ended up confirming hacks. The group has exploited a zero-day in the Oracle PeopleSoft ERP over the past two weeks.

Novo Nordisk discloses breach: Danish pharma giant Novo Nordisk says hackers gained access to some parts of its internal network. The company has taken the systems offline to investigate and evict attackers. Novo says some sensitive data, including patient PII, was copied during the intrusion. The company is widely known for developing the weightlosing drugs Ozempic and Wegovy. [Novo Nordisk]

Ransomware group claims Nintendo: Hackers are trying to extract a $2 million ransom payment from Japanese gaming company Nintendo. The Shadowbyt3$ group claims it stole almost 1GB of employee and business data from one of the company's suppliers named TINYpulse. Shadowbyt3$ launched in April and describes itself as a data extortion group only.

Humanity Protocol hacked for $36m: Hackers have stolen $36 million worth of crypto-assets from the Humanity Protocol platform. The attacker allegedly compromised a developer laptop and stole private multisig keys. The Humanity token lost nearly 90% of its value shortly after the hack. [Humanity Protocol // Wu Blockchain // Coin360]

OneNation site goes down: A DDoS attack has taken down the donation website for Australian far-right party OneNation. The party immediately blamed the attack on the "fearful Labor goons"—because why not attack your political rivals instead of investigating the source. [CyberDaily]

GSG hack: Hackers have stolen terabytes of data from the Global Schools Group, a major K–12 educational company that manages 12 school brands and 65 campuses across nine countries. FulcrumSec claims to have obtained passport details for children and parents, attendance records, teacher passwords, and photos of campus visitors. The data, and a lot more, was taken in April from an unsecured database exposed online. The hackers leaked the data last week after a ransom negotiation failed. FulcrumSec claims the school group's negotiator acted bizarrely, lied, and "deliberately aggravate[d]" them. [DataBreaches.net]

General tech and privacy

ICO to investigate smart TV makers: The UK's communications watchdog will begin investigating smart TV makers for illegal or hidden user viewing habits tracking. The UK ICO plans to launch several investigations throughout the year. The inquiries will check if device makers are obtaining consent, if users have opt-out options, and if children's rights and privacy are protected. The ICO is following in the footsteps of the Texas Attorney General Office, which sued several device makers for privacy violations and data tracking this year. [UK ICO]

GlobalSign revokes certs for Russian companies: Certificate authority GlobalSign is mass-revoking SSL certificates for Russian customers. The process started on Saturday and will take place in multiple revocation waves. GlobalSign told Russian partners it is complying with new CA/B Forum rules passed in May. The new rules require certificate authorities to follow strict customer verification procedures and follow international sanctions. [RBC // CA/B Forum]

Bug deletes all Ziggo password vaults: A technical malfunction has wiped the password vaults of Ziggo Safe Online, a password manager app run by Dutch ISP service Ziggo. The company confirmed the incident but declined to say how many users were affected. Ziggo says customers will have to re-download its app and resync passwords all over again. The Ziggo Safe Online lists more than 500,000 downloads on its Play Store page. [De Telegraaf]

Edge moves to two-week release cycle: The Microsoft Edge web browser will switch to a two-week release cycle starting late August, with the release of Edge version 152. Edge will sync with Chrome's new release cycle, which is also set to switch to two-week releases in September. The change from a four-week to a two-week pace was done to reduce the patch gap in its open-source components and deliver security updates faster. [Windows Blog // Chrome]

Government, politics, and policy

EDPB releases data breach notification template: The European Data Protection Board has published a standard data breach notification template to help companies report breaches and remain GDPR compliant. [EDPB]

Dilian flaunts Predatorgate evidence: Intellexa CEO Tal Dilian says he has documents to prove the Greek intelligence service's involvement in the Predatorgate spyware scandal. Dilian is threatening to release the documents after he was sentenced to 126 years in prison earlier this year. He claims his company only sold the spyware and that the EYP intelligence service was the one that used it against opposition figures, journalists, and prosecutors. In a controversial ruling, the Greek Supreme Court absolved the state of any involvement. Dilian said in March that he was being scapegoated for the government's own actions. [Dnews] [h/t Vas Panagiotopoulos]

UK police ask Apple for help with stolen phones: Apple and British police have entered a partnership to counter the rising trend of smartphone thefts. The UK police will share the IMEI codes of stolen devices with the US tech company to prevent the phones from being reactivated. The device data will also be used to track devices down and catch culprits. The market for stolen phones is estimated in the millions of US dollars. Most of the stolen phones are re-sold in China as devices without government restrictions. [BBC // The Sun]

The FBI's secret town: The FBI built a secret town in a Huntsville, Alabama warehouse to simulate and train investigators how cyber-attacks can impact critical services. [TechCrunch]

I got a tour of this earlier this year (long story, and it was the most insane thing I have ever seen in person.

[image or embed]

— Major Shamburger (@magnavore.bsky.social) June 14, 2026 at 8:55 AM

US urges NATO allies to replace Huawei gear: The US is pressuring NATO allies to use defense budgets to replace Huawei gear in their telecommunications and critical networks. The US designated Huawei a national security risk in 2020 and has barred American telcos from using its equipment. Some NATO countries followed the US' lead but Spain, Germany, and others allowed telcos to deploy Huawei gear in core telco networks. [Bloomberg ($) // The Next Web]

FISA expires for the first time: FISA Section 702 foreign surveillance powers have expired on Friday for the first time since the law passed in 2008. The US House of Representatives rejected a last-minute short-term extension. Members of both parties were dissatisfied with President Trump's decision to install close friend Bill Pulte as acting director of national intelligence. Lawmakers called Pulte unqualified for the role and the access FISA powers gave him. Lawmakers also failed to pass broader reforms to FISA legislation, which killed a long-term extension. [Axios // NBC News]

It failed miserably. Didn’t even get a simple majority. Let alone two-thirds.

198-218 https://t.co/663LDOXkhL

— Jake Sherman (@JakeSherman) June 11, 2026

US puts export restrictions on Mythos 5: The US government has imposed export control restrictions and ordered AI company Anthropic to block foreign nationals from accessing its new models. The order applies to Claude Fable 5 and Claude Mythos 5, released last week. The White House imposed the restrictions after Amazon reportedly found a jailbreak that granted full access to the model. The sudden Anthropic export controls have also made EU officials to double-down on their push of tech sovereignty and US independence. [Anthropic // TechCrunch // Euronews]

well there ya go

[image or embed]

— CAMERON WILSON (@cameronwilson.bsky.social) June 13, 2026 at 6:44 AM

Sponsor section

In this Risky Business sponsor interview, Catalin Cimpanu talks with Brandon Dixon, co-founder and CTO of Ent AI, on the company's innovative use of local LLMs to track user behavior on the endpoint, and add context to suspicious events to detect or prevent malicious activity.

Arrests, cybercrime, and threat intel

FBI disrupts Outsider Enterprise PhaaS: The FBI, Google, and Lumen have taken down a Chinese Phishing-as-a-Service platform named Outsider Enterprise. The platform has been linked to the theft of more than 3.8 million credit cards and $1.9 billion in losses from toll phishing scams. Officials have seized domains, server infrastructure, and cryptocurrency wallets used to receive payments. Google also sued the group for abusing its Gemini AI to build the service. [FBI // Google]

Vietnam arrests scam group: Vietnamese police have arrested seven individuals who were trying to establish cyber scam compounds across three of the country's regions. The group consisted of three locals and four Chinese nationals. They rented multiple resorts, farmstays, and villas and were bringing in scam workers from Cambodia. [The Business Times]

Conti member pleads guilty: A Ukrainian national has pleaded guilty to hacking US companies and deploying the Conti ransomware. Oleksii Oleksiyovych Lytvynenko was arrested in Ireland in July 2023 and finally extradited to the US last year. He faces up to 25 years in prison. [DOJ]

US disrupt deepfake porn service: French, Italian, and US authorities have shut down an online platform that generated and hosted non-consensual deepfake pornography of famous women. The US seized two domains while the platform's administrator was arrested in Nice, France, last week. The service allegedly hosted thousands of photos and videos of female politicians, first ladies, movie stars, athletes, and others. The domain seizures are the first under the US' new Take It Down Act. [DOJ // Paris Prosecutor's Office, PDF]

Cluster of malicious Chrome extensions: More than 150 malicious Google Chrome extensions are hijacking user activity as part of a complex ad fraud operation. The extensions are intercepting normal clicks and page navigations as part of a scheme to fabricate the origin of certain traffic. The clean traffic is then monetized through Google's ad network. The extensions are available through the official Chrome Web Store and were installed by more than 100,000 users. [Socket Security]

MeowProject forced to relocate after its own hack: A threat actor is targeting unpatched web apps and networking equipment as part of a large-scale campaign to collect cloud credentials. Attacks from the MeowProject group have been traced back to at least November of last year. The group was recently forced to relocate its backend servers after they themselves got hacked. They allegedly left servers unprotected online and were hit by crypto-mining gangs and had one of their databases held for ransom. [VulnCheck]

Malware technical reports

OnyxC2: A new infostealer named OnyxC2 is currently advertised on underground hacking forums. It includes all the standard features found in most stealers these days, such as the ability to harvest credentials and cookies from browsers, extensions, password managers, FTP clients, note-taking apps, and crypto wallets. [BlackFog]

TonRAT: ITOCHU's security team looks at TonRAT, a new remote access trojan distributed via Booking.com email phishing campaigns spreading malicious calendar invite files. [ITOCHU part 1 // ITOCHU part 2]

ProxyCB botnet is still alive: ProxyCB, a botnet from the early 2010s that was once used to send spam campaigns, is still alive, but now re-purposed as a proxy network to help disguise cyberattacks. [Rostelecom Solar]

Akira ransomware abuses Limewire sites: Some Akira affiliate is using a LimeWire-owned domain to store stolen data. [Huntress]

Shai-Hulud variants: Zscaler researchers analyze and compare the differences between all the Shai-Hulud worm variants, such as V1, V2, Miasma, and Hades. [Zscaler]

Sponsor section

In this edition of the Snake Oilers podcast, Ent AI co-founder Brandon Dixon introduces the company's intent-aware, AI-powered endpoint security control.

APTs, cyber-espionage, and info-ops

BlackCore was active in more countries: French officials have linked an Israeli company to disinformation campaigns ahead of elections in Angola, Togo, Scotland, and the city of New York. The campaigns seems to have targeted politicians supporting pro-Palestinian views. France's disinformation agency Viginum started investigating the company after the company also meddled in a French mayoral election earlier this year. [Viginum // Reuters]

Ghostwriter starts targeting personal Gmails: A cyber-espionage group operating out of Belarus is targeting the personal Gmail accounts of Polish citizens. The attacks are targeting high-profile Polish public figures, as well as their close family members. This includes politicians, journalists, employees of public administration, and law enforcement agents. This major change in tactics took place in March. Previously, the Ghostwriter group only targeted work-related accounts or those at Polish email providers. [CERT-PL]

Velvet Ant hides in a company's network for a decade: A Chinese cyber-espionage group has hacked and maintained access to a company's internal network for a decade. The hack succeeded even if the network was not connected to the internet. The hackers managed to pivot to the internal network by replacing the PAM and OpenSSH binaries on some hosts and collecting the needed credentials. Security firm Sygnia tracks the group as Velvet Ant. [Sygnia]

APT-C-08 phishing: One of Qihoo's security teams looks at a spear-phishing campaign carried out by a group tracked as APT-C-08 (Manling Flower, Bitter). [Qihoo 360]

Famous Chollima's Google Docs campaign: North Korea hacking group Famous Chollima has used Google Docs to host fake job adverts and employment that eventually get applicants infected with malware. [KMSec]

ulnerabilities, security research, and bug bounty

.vuln TLD: Looks like someone is working to register a .vuln top-level domain. The process appears to be in its early phase and the .vuln TLD doesn't yet appear to be live in IANA's list of official TLDs yet. [Andrew Nesbitt // IANA TLD list]

GreatXML Bitlocker bypass: A security researcher going by Nightmare Eclipse has published details on a new Windows zero-day that can be used to bypass BitLocker protections. The bypass has pretty complex requirements, so it's hard to see this ever exploited in the wild. [Nightmare Eclipse // Cyderes]

BUMSRAKETE vulnerability: The FreeBSD operating system has patched a local privilege escalation bug tracked as CVE-2026-45257. The bug also goes by BUMSRAKETE and has a glorious homepage for the ages. [BUMSRAKETE // FreeBSD]

ITScape vulnerability: A new vulnerability can allow attackers to escape Linux virtual machines and execute malicious code as root on the underlying host. The vulnerability, codenamed ITScape, impacts the Kernel-based Virtual Machine (KVM) component. It only impacts multi-tenant public clouds that use KVM on Arm64 processors. The bug was discovered by security researcher Hyunwoo Kim and was patched in the Linux kernel last week. [Hyunwoo Kim on GitHub // CVE-2026-46316 patch // SecList]

AMD finally fixes update hijack bug: AMD has finally patched a bug that could have allowed MitM attacks against its poorly secured auto-update mechanism. [MrBruh // CVE-2026-40677 // Tom's Hardware]

Check Point VPN zero-day write-up: WatchTowr researchers have published a technical write-up looking at how a recent zero-day in Check Point VPN actually works. The main finding is that the zero-day is also exploited via port 443/TCP and not just 500/UDP. [WatchTowr Labs // CVE-2026-50751]

Splunk forgets about authentication: There's a bug in Splunk Enterprise running on AWS where the platform's PostgreSQL database does not require authentication to access the stored data. [WatchTowr Labs // CVE-2026-20253]

Infosec industry

Threat/trend reports: Chainguard, Confiant, HP Wolf Security, and Netwrix have recently published reports and summaries covering various threats and infosec industry trends.

NIST finalizes SCAP: The US National Institute of Standards and Technology has finalized the Security Content Automation Protocol (SCAP), a multi-purpose framework of component specifications that support automated configuration, vulnerability, patch checking, security measurement, and technical control compliance activities. [US NIST]

BSides Boulder 2026 streams: Live streams from the BSides Boulder 2026 North America security conference, which took place over the weekend, are available on YouTube. 

ContinuumCon 2026 streams: Live streams from the ContinuumCon 2026 security conference, which took place over the weekend, are available on YouTube. 

fwd:cloudsec NA 2026 videos: Talks from the fwd:cloudsec 2026 North America security conference, which took place last month, are available on YouTube. 

Risky Business podcasts

In this episode of Risky Business Features, James Wilson is joined by Open Source Malware Security co-founder Paul McCarty to talk about the supply chain attack mitigations coming in NPM v12.