The UNC6783 group impersonates IT support staff by phone, then redirects victims to fake Okta login pages to bypass MFA in real time. A practical guide for detection and defense.
Behind the Axios supply chain attack lies a 6-month social engineering operation. UNC1069 (North Korea) built a trust relationship with maintainer Jason Saayman before stealing his npm credentials.
Open source project maintainers have become priority targets for state-sponsored actors like UNC1069. A breakdown of the tactics used and concrete defenses maintainers can implement to protect their npm, PyPI accounts and publishing credentials.
Drift officially confirms the $285 million attack against its DeFi protocol was planned six months in advance by North Korean state-sponsored hackers from group UNC4736. Funds were bridged to Ethereum and laundered via Tornado Cash.
On April 1, 2026, Drift Protocol lost $285 million in the largest DeFi attack of the year. Technical analysis: Solana durable nonce abuse, 2-of-5 multisig compromise via social engineering, attribution to North Korea.
Microsoft DART reveals an active vishing campaign via Teams where attackers impersonate IT support and use Quick Assist to take control of workstations.