ClickFix Campaigns Targeting Windows and macOS

Insikt Group identified five distinct clusters using the ClickFix social engineering technique for initial access. These clusters impersonate various services like Intuit QuickBooks and Booking.com, demonstrating operational variance but similar core techniques. ClickFix manipulates victims into executing malicious commands within native system tools, bypassing traditional security controls. The methodology has become a standardized template for cybercriminals and APT groups. Campaigns target diverse sectors and use sophisticated obfuscation and living-off-the-land tactics. Defenders are advised to implement aggressive behavioral hardening and user awareness training to mitigate these threats.

Pulse ID: 69c458219c8e6f0a874e9161
Pulse Link: https://otx.alienvault.com/pulse/69c458219c8e6f0a874e9161
Pulse Author: AlienVault
Created: 2026-03-25 21:48:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #ICS #InfoSec #Mac #MacOS #OTX #OpenThreatExchange #RAT #SocialEngineering #Windows #bot #AlienVault

グダペスト吐き祭り
又してもペストが飛び交う

https://www.pixiv.net/novel/show.php?id=26657698

<>

#front #line #giant #hornet #crush #sewer #rat #fallen #angel #Babaya #sow #seed #judgment #burn #filthy #vermin #wolve #turn #Zok #into #beehive #rhino #propelled #pumpkin #fire #skies #sacred #earth #falcon #hunt #crow

Gudapest Spitting Festival
The plague spreads again

https://www.pixiv.net/novel/show.php?id=26657718

<>

#front #line #giant #hornet #crush #sewer #rat #fallen #angel #Babaya #sow #seed #judgment #burn #filthy #vermin #wolve #turn #Zok #into #beehive #rhino #propelled #pumpkin #fire #skies #sacred #earth #falcon #hunt #crow

Фестиваль плювання в Гудапешті
Чума знову поширюється

https://www.pixiv.net/novel/show.php?id=26657727

<>

#front #line #giant #hornet #crush #sewer #rat #fallen #angel #Babaya #sow #seed #judgment #burn #filthy #vermin #wolve #turn #Zok #into #beehive #rhino #propelled #pumpkin #fire #skies #sacred #earth #falcon #hunt #crow

Malicious PyPI Package - LiteLLM Supply Chain Compromise

A malicious supply chain attack has been discovered in the Python Package Index package litellm version 1.82.8. The compromised package contains a malicious .pth file that executes automatically when the Python interpreter starts, without requiring explicit import. This file, located in site-packages/, exfiltrates sensitive information including environment variables, SSH keys, and cloud credentials to an attacker-controlled server. The payload is double base64-encoded to evade basic static analysis. PyPI administrators have quarantined the project to limit its spread. Users are advised to check for the malicious file, rotate all potentially exposed credentials, and audit their PyPI publishing process. The attack is attributed to TeamPCP and is actively exploited in the wild.

Pulse ID: 69c3bb2520934c9e0b4e5dca
Pulse Link: https://otx.alienvault.com/pulse/69c3bb2520934c9e0b4e5dca
Pulse Author: AlienVault
Created: 2026-03-25 10:38:29

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cloud #CyberSecurity #InfoSec #OTX #OpenThreatExchange #PyPI #Python #RAT #SSH #SupplyChain #Troll #bot #AlienVault

Supply Chain Attack: Malicious PyPI Packages

TeamPCP has launched a supply chain attack targeting LiteLLM, an open-source Python library used in 36% of cloud environments. Malicious versions 1.82.7 and 1.82.8 were published on PyPI, employing sophisticated techniques for payload delivery and persistence. The compromised packages exploit Python's .pth mechanism for stealthy execution across any Python process. The malware collects sensitive data including API keys, cloud credentials, and CI/CD secrets, encrypting and exfiltrating them to attacker-controlled domains. This attack follows TeamPCP's previous compromises of Aqua Security's Trivy and Checkmarx tools, highlighting an ongoing campaign against the open-source ecosystem. The incident underscores the potential for widespread impact and the need for vigilance in software supply chain security.

Pulse ID: 69c3bb29c62248c6ffd0b50c
Pulse Link: https://otx.alienvault.com/pulse/69c3bb29c62248c6ffd0b50c
Pulse Author: AlienVault
Created: 2026-03-25 10:38:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cloud #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PyPI #Python #RAT #RCE #SupplyChain #Troll #bot #AlienVault

グダペスト吐き祭り
又してもペストが飛び交う

https://note.com/poison_raika/n/n636781f116fd

<>

#front #line #giant #hornet #crush #sewer #rat #fallen #angel #Babaya #sow #seed #judgment #burn #filthy #vermin #wolve #turn #Zok #into #beehive #rhino #propelled #pumpkin #fire #skies #sacred #earth #falcon #hunt #crow

Gudapest Spitting Festival
The plague spreads again

https://note.com/poison_raika/n/n69b10c7741e4

<>

#front #line #giant #hornet #crush #sewer #rat #fallen #angel #Babaya #sow #seed #judgment #burn #filthy #vermin #wolve #turn #Zok #into #beehive #rhino #propelled #pumpkin #fire #skies #sacred #earth #falcon #hunt #crow