Behind the Axios supply chain attack lies a 6-month social engineering operation. UNC1069 (North Korea) built a trust relationship with maintainer Jason Saayman before stealing his npm credentials.
Open source project maintainers have become priority targets for state-sponsored actors like UNC1069. A breakdown of the tactics used and concrete defenses maintainers can implement to protect their npm, PyPI accounts and publishing credentials.
On April 1, 2026, Drift Protocol lost $285 million in the largest DeFi attack of the year. Technical analysis: Solana durable nonce abuse, 2-of-5 multisig compromise via social engineering, attribution to North Korea.
Microsoft DART reveals an active vishing campaign via Teams where attackers impersonate IT support and use Quick Assist to take control of workstations.