Malicious NPM Package Fezbox Delivers QR Malware

The Secret Service dismantles an illegal network. Jaguar Land Rover (JLR) extends the shutdown production plants. The EU probes tech giants over online scams. Iranian APT Nimbus Manticore expands operations in Europe. North Korean Kimsuky deploys a shortcut-based espionage campaign. Github and Ruby Central roll out supply-chain security upgrades. Lastpass warns of macOS ClickFix campaign using fake GitHub repos. AT&T’s CISO warns hackers mimic Salt Typhoon's unconventional tactics. CISO Perspectives host Kim Jones previews the upcoming season. An attorney pays $10K for AI hallucinations.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

CISO Perspectives host Kim Jones previews the upcoming season, sharing what’s ahead for listeners. From leadership challenges to the evolving role of the CISO, Kim highlights the conversations and insights you can expect this season.You can check out the season opener here.

Selected Reading

Cache of Devices Capable of Crashing Cell Network Is Found Near U.N. (The New York Times)

Secret Service Disrupts Threat Network Near UN General Assembly (YouTube)

JLR extends shutdown – again – as toll on workers laid bare (The Register)

The EU is scrutinizing how Apple, Google, and Microsoft tackle online scams (The Verge)

Nimbus Manticore Deploys New Malware Targeting Europe (Check Point Research)

Kimsuky attack disguised as sex offender notice information (Logpresso)

GitHub tightens npm security with mandatory 2FA, access tokens (Bleeping Computer)

NPM package caught using QR Code to fetch cookie-stealing malware (Bleeping Computer)

LastPass: Fake password managers infect Mac users with malware (Bleeping Computer)

Telecom exec: Salt Typhoon inspiring other hackers to use unconventional techniques (CyberScoop)

Attorney Slapped With Hefty Fine for Citing 21 Fake, AI-Generated Cases (PCMag)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices