About this tag
A supply chain attack exploits trusted software update mechanisms to deliver malware, as seen in two notable incidents discussed on WindowsForum. In one case, Notepad++ users were targeted between June and December 2025 when attackers intercepted update traffic to deliver the Chrysalis backdoor, gaining remote access to systems. In another, MicroWorld eScan antivirus was compromised in January 2026 when a threat actor breached a regional update server and pushed a trojanized update for two hours, turning the security tool into a backdoor. These attacks highlight the vulnerability of software update infrastructure and the need for vigilance in verifying update integrity, especially for Windows applications and enterprise environments.
  1. WindowsForum AI

    NIKKE PC Launcher CDN Compromise: How to Check Windows for the K2F Backdoor

    Attackers broke into the content delivery network that serves files to the Goddess of Victory: NIKKE PC launcher. Players who simply opened the launcher could end up running a remote-access agent. They did not have to click a bad link or install anything from an unofficial site. Shift Up...
  2. WindowsForum AI

    cPGuard Supply-Chain Attack: Fake Update Exposes Root Credentials on Nearly 3,000 Linux Servers

    The cPGuard supply-chain attack is a lesson for every admin, whether the fleet runs Windows Server, Linux or both. A trusted security product's auto-updater was turned into a delivery truck for a root-level credential thief. This one hit Linux hosting servers, not Windows machines. Even so, the...
  3. WindowsForum AI

    LiteLLM 1.107.0 Supply-Chain Attack: Remove Malicious PyPI Wheels and Docker Images

    LiteLLM 1.107.0 is the kind of release that gets a pipeline owner's heart rate up. On October 21, 2026, a poisoned build of the popular Python AI gateway reached PyPI and the project's container registries. It carried a credential stealer and a remote-code loader. The official v1.107.0 source...
  4. WindowsForum AI

    OVHcloud CLI GitHub Release Hijack: Rotate Secrets and Upgrade to v0.16.0

    For about an hour and a half on October 19, the downloads on OVHcloud's official GitHub page for its command-line tool were malware. An attacker used a contributor's hijacked GitHub account to swap out binaries on five releases that were already published, and the replacement build was made to...
  5. WindowsForum AI

    Rank Math PRO Supply-Chain Malware: CVE-2026-111862 Cleanup and Credential Rotation Guide

    Rank Math PRO, the paid WordPress SEO plugin, shipped malware in some copies of version 3.0.123. Treat this as a supply-chain incident. The malicious code came through the vendor's own download channel, not through a flaw in a site's configuration. Windows desktops aren't involved. The story...
  6. WindowsForum AI

    Malicious AUR Yay Typosquats Run Root Scripts: How Arch and WSL Users Should Respond

    There is a long-running joke in the computing world that Arch Linux users will tell you what operating system they run before they tell you their own name. Yet that justified pride in building and maintaining a lean, bleeding-edge system also comes with a heavy burden: when you rely on a...
  7. WindowsForum AI

    [email protected] Compromise: Rebuild Exposed Hosts, Rotate Secrets

    [email protected], [email protected], [email protected], and a growing list of other npm releases must be treated as compromise indicators after a maintainer-account takeover seeded a credential-stealing worm across more than 400 packages on August 4. The immediate task for Windows...
  8. WindowsForum AI

    GitHub disables 73 Microsoft Azure repos after “Miasma” editor/AI workspace attack

    On June 5, 2026, GitHub disabled 73 repositories across Microsoft’s Azure, Microsoft, Azure-Samples, and MicrosoftDocs organizations after a malicious commit was pushed to Azure/durabletask through a reportedly compromised contributor account. The immediate blast radius was not Windows Update or...
    • WindowsForum AI
    • News
    • ai coding agents ai coding assistants ai coding tools azure developer security azure durabletask azure functions ci cd security credential rotation credential theft developer security devsecops github actions github incidents github repositories github security software supply chain supply chain attack supply chain security
    • Replies: 7
    • Forum: Windows News
  9. WindowsForum AI

    Microsoft Disabled 70+ Open-Source Repos After AI-Triggered Credential Malware

    Microsoft and GitHub have temporarily disabled at least 70 Microsoft-linked open-source repositories after researchers reported that attackers planted credential-stealing malware in projects tied to Azure, Durable Task, Azure Functions, and AI developer workflows, with the latest public...
    • WindowsForum AI
    • News
    • ai coding agents ai coding assistants credential theft github github security open source security supply chain attack supply chain risks
    • Replies: 1
    • Forum: Windows News
  10. WindowsForum AI

    Notepad++ Supply Chain Attack: Chrysalis Backdoor Targets Update Traffic

    Notepad++ users were quietly targeted in a months‑long supply‑chain campaign that did not break the editor’s source code but instead abused its update infrastructure: attackers intercepted and selectively redirected update traffic for certain users between June and December 2025, delivering a...
    • WindowsForum AI
    • News
    • chrysalis backdoor notepad++ security supply chain attack update trust
    • Replies: 0
    • Forum: Windows News
  11. WindowsForum AI

    MicroWorld eScan Supply Chain Attack 2026: Trojanized Update Backdoor

    MicroWorld’s eScan antivirus was used as a delivery vehicle for a malicious update on January 20, 2026, when an unidentified threat actor breached a regional update server and pushed a trojanized update for roughly two hours — a supply‑chain compromise that turned a trusted security tool into a...