npm malware campaign stealing developer credentials across platforms

Posted in Commentary with tags on October 30, 2025 by itnerd

Recently, cybersecurity researchers disclosed two sophisticated npm malware campaigns targeting developer credentials across Windows, macOS, and Linux systems. Socket researchers discovered 10 malicious packages with over 9,900 downloads, while Koi Security identified an ongoing campaign dubbed PhantomRaven involving 126 infected packages with 86,434 downloads. Both campaigns use advanced evasion techniques: PhantomRaven exploits Remote Dynamic Dependencies and AI-driven “slopsquatting,” while the Socket-discovered malware uses four layers of obfuscation to harvest credentials from system keyrings, browsers, and authentication services.

You get more details here: 10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux

CTO of DryRun Security, Ken Johnson had this comment:

“Attackers are getting better at blending in. The fake “nodejs-smtp” package posing as Nodemailer and a swarm of ten typosquatted npm packages prove it. These weren’t one-off prank packages tossed onto the registry, they behaved like legitimate libraries while performing post-install tricks that turn normal developer workflows into an attack surface.

Both incidents share the same playbook: abuse the packaging and install steps. In the nodejs-smtp case the attacker unpacked and modified an app archive and repackaged it; in the recent npm cluster the payload is triggered automatically via postinstall hooks, spawns a separate terminal to run an obfuscated loader, shows a fake CAPTCHA and then pulls a large PyInstaller stealer. That stealer targets system keyrings, browsers, SSH keys and other persisted secrets on Windows, Linux and macOS, exactly the kinds of credentials developers and CI systems rely on every day.

Vetting dependencies is necessary but no longer sufficient. Teams need visibility and controls that extend beyond “what” is pulled from npm or PyPI to cover “what happens next” packaging, install scripts, build artifacts and runtime behavior. Postinstall hooks, repackaging steps, and terminal-spawned payloads are all legitimate mechanisms that attackers now weaponize, so they deserve attention.

Operationally that means treating installs and builds as untrusted execution: run package installs in ephemeral, isolated CI containers; require reproducible builds and signed artifacts; scan for postinstall hooks and typosquatted names before they reach CI; monitor outbound connections from build hosts; and lock down access to OS credential stores (or use vaults that don’t expose plaintext secrets). Add integrity checks and SBOMs into the pipeline so you can detect unexpected changes to archives and binaries early.

In short: shrink the implicit trust you place in the build and install process. The boundary that used to stop at “dependency X is okay” has moved and attackers are now weaponizing packaging and install-time behavior to reach secrets and persistence. If you only scan package names and static source, you’ll miss the parts of the pipeline where real compromise happens.”

Developers are a key part of security. Thus they need to make sure everything that they do is focused on putting out code that is secure by default. These days it’s a requirement to do so.

When a “Contact Us” Form Becomes “Contact a Cybercriminal” 

Posted in Commentary with tags on October 30, 2025 by itnerd

This morning, the KnowBe4 Threat Lab published a new threat alert regarding an emerging phishing attack whereby cybercriminals are exploiting companies through their ‘Contact Us’ or ‘Book Appointment’ forms. 

This alert breaks down how exactly these bad actors are leveraging these prevalent forms, examples of what it looks like, and the overall impact of such an impact. The alert finds that since September 11th, 2025, this attack form has begun to emerge, and predicts that it will only continue to increase as hackers hijack legitimate communications to meet their ends. 

For full details, the threat findings can be found here: https://blog.knowbe4.com/when-a-contact-us-form-becomes-contact-a-cybercriminal

Fortra Threat Hunts Reveal Emerging MITRE Attack Techniques 

Posted in Commentary with tags on October 30, 2025 by itnerd

Fortra Intelligence and Research Experts (FIRE) initiated more than 2,700 threat hunts across customer environments in August 2025. Using the MITRE ATT&CK framework, FIRE has identified and is sharing the top tactics and the most common techniques used in these attacks.

Identifying these evolving attacker behaviors is a key component to helping security teams strengthen defenses and disrupt threats before they escalate, in addition to understanding how threat actors are refining social engineering and cloud exploitation techniques.

You can read the research here: Top Threat Hunting Metrics & Outcomes | Fortra

Rogers Xfinity Pro Brings Canadians an Elevated WiFi Experience

Posted in Commentary with tags on October 30, 2025 by itnerd

Rogers today announced that Rogers Xfinity is bringing next-generation WiFi to more Canadians with Rogers Xfinity Pro. Our most elevated WiFi experience, available as an optional add-on for all Rogers Xfinity Internet plans, includes an upgrade to our best-in-class WiFi 7-enabled gateway with device prioritization and WiFi back up with Storm Ready WiFi to keep customers connected through the unexpected.

Rogers Xfinity Pro elevates in-home WiFi coverage and includes the best technology to enhance and extend customers’ home WiFi network for an even better experience. With Rogers Xfinity Pro, customers can Boost a Device to get the best possible WiFi connection to the device that matters most. The new monthly add-on also includes WiFi backup to stay connected during power or network outages with Storm-Ready WiFi.

The next-generation Rogers Xfinity Gateway, available with Rogers Xfinity Pro, includes trailblazing WiFi 7 technology that can deliver multi-gig speeds over WiFi and connect more devices – all on Canada’s most reliable internet*

To learn more about Rogers Xfinity Pro, visit rogers.com/rogers-xfinity-pro.

Education Ransomware Roundup: Q1-Q3 2025 stats on attacks, ransoms, and data breaches

Posted in Commentary with tags on October 30, 2025 by itnerd

Comparitech researchers have published a detailed study looking at ransomware attacks against the educations sector for the first three quarters of 2025.

According to the study, 180 attacks on the education sector occurred in this time period. This is a 6% increase from the same period in 2024. Despite these higher figures, the last two quarters of 2025 do offer a more positive outlook for the education sector, with significantly lower numbers of attacks than the previous three quarters. 

This study dives into all things education ransomware attacks — including the average ransomware demand across these attacks, which ransomware gangs were the most prolific in this sector, which countries were most impacted, as well as which attacks were the largest in this period. 

Key findings for Q1-Q3 2025

  • 180 attacks in total
  • 63 confirmed attacks
  • 117 unconfirmed attacks
  • 227,214 records are known to have been breached in the confirmed attacks
  • Average ransom demand across all attacks = $444,400 million
  • The US and UK have seen a similar number of attacks (when compared to the same period of 2024), while attacks in France have doubled and Australia, Brazil, and Spain have seen a number of attacks despite recording none in the first nine months of 2024
  • The ransomware strains that claimed the most attacks against schools, colleges, and universities were Qilin (24), Fog (18), SafePay (17), Interlock (13), and INC (12)
  • Interlock took credit for the most confirmed attacks (8), followed by Fog (7), Qilin (6), and SafePay, Medusa, Nova, and Kairos (3 each)
  • Nearly 233 TB of data was allegedly stolen across all attacks

You can read the study here: https://www.comparitech.com/news/education-ransomware-roundup-q1-q3-2025-stats-on-attacks-ransoms-and-data-breaches/

Adaptix Ties to Russian Criminal Underworld, Threat Actors Harness Open-Source Tool for Malicious Payload

Posted in Commentary with tags on October 30, 2025 by itnerd

Silent Push has published new research in which its threat analysts uncover threat actors using Adaptix, a free and open source tool commonly used by penetration testers, to deliver malicious payloads. Silent Push has observed heavy ties linking Adaptix to Russia and the Russian criminal underworld. 

Abuse of Adaptix was first discovered during Silent Push’s research on the new malware CountLoader, which they reported previously. Soon after signatures were added to Silent Push detection methods, several public reports highlighted the surge in threat actors using Adaptix in global ransomware campaigns. 

Silent Push has identified a potential threat actor with significant ties to Russia who goes by the handle “RalfHacker,” appears to be a developer behind Adaptix, and manages a Russian language sales Telegram channel for the tool. 

The research can be found here: https://www.silentpush.com/blog/adaptix-c2.

Ontario Tech University answers the call to ensure AI serves humankind and the planet

Posted in Commentary with tags on October 30, 2025 by itnerd

From households to classrooms and workplaces, artificial intelligence (AI) has become deeply integrated into everyday life. As this technology’s influence accelerates worldwide, the need for leadership rooted in ethics, good governance and accountability has never been greater. Challenges and opportunities lie in balancing promise with risk so that innovations serve people and the planet.

Ontario Tech University is advancing initiatives that will establish the university, and Canada, as a global leader in ethically designed and executed AI. Through the launch of its School of Ethical Artificial Intelligence and Mindful Artificial Intelligence Research Institute, the university is setting the benchmark for human-centred innovation that’s anchored in values and guided by conscience. 

A framework for ethical AI

Achieving trust in AI and creating a more inclusive future requires researchers, industry, policymakers and the government to work together to confront the questions that influence AI’s design and use. The university’s AI commitment is grounded in four principles that safeguard the development of emerging technologies through care, conscience and social accountability:

  • Prioritizing privacy by design.
  • Ensuring robust data protection.
  • Minimizing algorithmic bias.
  • Addressing environmental consequences.

Building a future led by ethical leaders

Ontario Tech is not watching from the sidelines; it’s leading with bold, immediate actions to prepare students for the careers of today, and for those yet to be imagined.  

The university’s School of Ethical Artificial Intelligence unites experts across multiple disciplines, from computer science and business to engineering, education, health and social sciences, equipping students with technical expertise and preparing them to be responsible change-makers who understand how to apply critical thinking to AI systems and their outputs.

The university’s more than 65 AI-related courses help students gain the knowledge and skills to channel AI’s power toward serving society, and graduate ready to lead the workforce with integrity and purpose.

Advancing research through a mindful AI lens

The launch of the Mindful Artificial Intelligence Research Institute (MAIRI) reinforces Ontario Tech’s global reputation for thoughtful, intentional, inclusive and human-centred innovation. Bringing together more than 50 researchers from every faculty, MAIRI unites interdisciplinary expertise with key partnerships spanning academia, industry and government to explore AI’s role in advancing well-being and global flourishing.

MAIRI exemplifies Ontario Tech’s tech with a conscience ethos: innovation grounded in high ethical standards. This approach moves beyond emphasizing rapid technological and economic advancement, to consider how AI can make life better for people and communities.

Applying responsible AI in the real world

The university’s work in trustworthy AI moves beyond theory; it’s practical, measurable, responsibly designed and already changing lives:
  

  • The university works with Ontario Shores Centre for Mental Health Sciences to identify and remove potential systemic bias and discrimination in AI systems that influence patient outcomes and care access.   
  • In partnership with the Canadian National Institute for the Blind, the university explores ways to build accessibility considerations into the design of AI from the start, empowering people of all abilities to contribute to and benefit from technological innovations. Insights from this work are already informing new federal AI standards.

Learn more about SEAI, MAIRI and Ontario Tech’s leadership in responsible AI innovation: ontariotechu.ca/ai.

Hackers Impersonating Luxury Brands, Gucci, Louis Vuitton, and Rolex

Posted in Commentary with tags on October 30, 2025 by itnerd

BforeAI has releasee its latest research identifying over 1,000 domains leveraging the popularity of luxury brands in a campaign leading up to the high-traffic holiday season. These domains show coordinated registration patterns, with registrar preferences, top level domain abuse, and linguistic tricks. 

The campaign primarily impersonates high-end fashion and luxury brands, using domain strings impersonating or abusing names such as Gucci, Prada, Louis Vuitton, Rolex, Chanel, Dior, Versace, and Dolce & Gabbana. 

Since luxury retail brands are less frequently purchased online, these hackers are offering coupons and discounts to attract visitors.

You can read the research here: https://bfore.ai/report/luxury-fashion-brands-threats-in-2025-holiday-shopping-season/

National Film and Sound Archive of Australia Selects Arcitecta’s Mediaflux to Power the Nation’s Audiovisual Heritage Strategy

Posted in Commentary with tags on October 29, 2025 by itnerd

Arcitecta, a creative and innovative data management software company, today announced that the National Film and Sound Archive of Australia (NFSA) has selected Arcitecta’s Mediaflux® platform to serve as its central Digital Asset Management System (DAMS), marking a significant step in its digital transformation journey. This initiative is part of a broader strategy to enhance the discoverability, preservation and public accessibility of Australia’s audiovisual heritage, ensuring its continued relevance and value for future generations.

As digital assets grow at an unprecedented rate, traditional storage models and outdated workflows are no longer sufficient for institutions committed to preserving and providing access to cultural heritage. The NFSA faced mounting challenges in managing the scale, complexity and growing demand for access to its digital collections. Key requirements for its transformation included the ability to:

  • Enhance digital discovery and engagement through improved online experiences and social platform integration;
  • Replace legacy systems with a state-of-the-art, centralized platform that streamlines workflows and integrates seamlessly with existing collection and exhibition management tools;
  • Support the government-funded digitization of at-risk materials across multiple National Cultural Institutions; and
  • Automate external contributor workflows and reduce reliance on manual, labor-intensive asset handling processes.

NFSA selected Arcitecta’s Mediaflux following a rigorous evaluation, in which it distinguished itself with a unified, intelligent approach to data management. The platform delivers scalable, future-proof capabilities for metadata enrichment, long-term preservation and seamless integration with NFSA’s broader digital ecosystem. Mediaflux enables intelligent data tiering, automation and policy-driven governance—eliminating silos while enhancing operational efficiency.

This project reflects a larger trend within the GLAMs (galleries, libraries, archives and museums) sector as institutions adopt scalable, cloud-ready and metadata-driven platforms to address the growing demands of digital stewardship, research innovation and public engagement.

Through a multi-phase implementation, NFSA will modernize its workflows, making it significantly easier for external contributors to submit and access materials. The project is designed to support the long-term preservation of Australia’s cultural legacy while equipping NFSA with cutting-edge tools for managing digital assets. 

The first phase is focused on three key areas to optimize critical aspects of NFSA’s operations:

  1. Intelligent Metadata Management – Mediaflux will automate metadata ingestion and contextual enrichment, improving archival searchability and aligning with evolving storage formats.
  2. Next-Gen Collections Management – A robust digital accessioning workflow will streamline how new materials are curated and preserved.
  3. Seamless Contributor Interaction – An intuitive web portal will allow external parties—broadcasters, donors, and production houses—to securely deposit and withdraw digital assets, simplifying ingest and access.

To support these initiatives with a strong technical foundation, NFSA is integrating advanced infrastructure and storage solutions tailored for performance, scalability, and sustainability. Wasabi’s cloud storage integration, managed by Mediaflux, offers cost-effective scalability, no egress fees and intelligent tiering to optimize storage efficiency and sustainability.

Dell PowerScale flash and archive solutions are powering the high-speed digitization and long-term preservation of archive collections, enabling instant access to priceless history at scale.

Why Mediaflux

Mediaflux enables organizations to unify and consolidate digital assets across diverse formats and departments within a single, cohesive platform. Purpose-built for petabyte-scale data environments, it delivers real-time performance and advanced metadata automation to streamline complex workflows. Mediaflux combines deep domain expertise with flexible customization. Its robust capabilities also unlock new monetization and audience engagement opportunities by making enriched collections more accessible than ever before.

In addition, Arcitecta’s proven track record delivering DAMS solutions to institutions, combined with its deep experience in complex, multi-industry environments, gave NFSA confidence in its ability to provide reliable support, ongoing maintenance and adaptability to future needs.

Resources

Fubo, Disney’s Hulu + Live TV Complete Business Combination

Posted in Commentary with tags on October 29, 2025 by itnerd

FuboTV and The Walt Disney Company today announced they have closed the previously announced transaction to combine Fubo’s business with Disney’s Hulu + Live TV business.

The newly combined Fubo and Hulu + Live TV business creates a truly unique virtual MVPD (vMVPD) and the sixth largest Pay TV company in the U.S. with nearly 6 million subscribers in North America. The combined company offers consumers a broad set of sports, including more than 55,000 live sporting events, and entertainment-focused programming offerings from Fubo and Hulu + Live TV.

Fubo and Hulu + Live TV will continue to be available to consumers as separate and distinct services, each offering consumers multiple plan options from skinny to robust at compelling price points. Hulu + Live TV will continue to be streamed in the Hulu app and offered as part of an entertainment-focused bundle with Hulu, Disney+ and ESPN Unlimited. Fubo will continue to serve viewers in the Fubo app.

The combined business expects to realize cost, revenue and operational synergies through content cost savings achieved by more flexible programming packaging, advertising optimization and sales and marketing opportunities. The combined company will have access to a $145 million term loan that Disney has committed to provide Fubo in 2026 as part of the Transaction.