Cyber defenders are seeing two (2) connected surges: tax‑season email scams aimed at everyday users and finance teams, and software supply‑chain attacks aimed at developers and CI/CD pipelines. On the tax side, attackers imitate IRS/tax communications (refunds, W‑2s, filing reminders, “tax professional” requests) to push victims into clicking links, scanning QR codes, or opening files that steal Microsoft 365 credentials and even MFA codes. Microsoft also observed a large IRS‑impersonation wave hitting 29,000+ users across 10,000 organizations, where a fake “IRS Transcript Viewer” led to remote‑access tooling being installed. Instead of “custom malware” that is easier to spot, many campaigns abuse legitimate remote management tools (e.g., ScreenConnect/Datto/SimpleHelp) to blend into normal IT activity while giving attackers persistent access. In parallel, the Trivy incident shows how one compromised credential can ripple outward. Attackers published trojanized Trivy artifacts via trusted channels (including Docker Hub tags), turning routine security scanning into secret theft inside build environments. Those stolen secrets then fueled CanisterWorm, which infected npm packages using post‑install scripts to drop a Python backdoor and persist via a disguised system service. These were especially impactful in CI/CD and Linux build hosts. What makes CanisterWorm unusually resilient is its use of a decentralized Internet Computer (ICP) canister as a “dead drop” to fetch the next payload URL, letting the attacker swap instructions centrally while making takedown harder. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- TheHackerNews: Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware article
- TheHackerNews: Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper article
- TheHackerNews: Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages article