Recent cybersecurity incidents underscore the escalating risks in software supply chains and social engineering tactics. A supply chain attack compromised Gluestack’s NPM packages, which are downloaded nearly a million times weekly. Attackers injected malicious code that facilitates data theft, remote access, and ongoing malware deployment. Researchers also discovered additional advanced malware within these packages, including backdoors and destructive payloads, highlighting the urgent need for vigilant package management and swift patching. Concurrently, a campaign utilizing the ClickFix social engineering has targeted macOS users. They use fake web pages to impersonate trusted services like Spectrum and trick victims into executing shell scripts that install info stealers and RATs. These attacks, attributed to Russian-speaking threat actors, exploit human trust and routine verification processes. Collectively, these incidents highlight the critical importance for organizations and individuals to adopt comprehensive security practices, including thorough code review, vigilant monitoring, and user awareness, to defend against increasingly sophisticated cyber adversaries. CTIX analysts will continue to report on the latest malware strains and attack methodologies.