Intelligence Feed

1w ago · datadog-security-labs

On October 21, 2026, a malicious version (1.107.0) of the popular Python package litellm was published to PyPI and Docker registries via a compromised build pipeline. Attackers used stolen GitHub CLI OAuth tokens to publish the package from a malicious fork, Berri-AI/litellm, which dropped persistent malware files that execute on every Python startup. The payload included a credential stealer exfiltrating cloud, developer, AI, and browser credentials, and a backdoor capable of downloading and executing remote code. The malicious release was available for approximately two hours before removal.

1w ago · datadog-security-labs

PHP disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. These flaws allow unauthenticated attackers to execute arbitrary commands on affected PHP deployments by exploiting memory exhaustion and stale state reuse during request processing. Exploitation attempts were observed in the wild as early as October 17, 2026, four days before public disclosure. The vulnerabilities affect all PHP web deployments, including Apache modules, PHP-FPM, and CGI setups. Successful exploitation does not require application-level authentication and can result in shell command execution under the web server's privileges without necessarily crashing the worker process.

2w ago · datadog-security-labs

Researchers demonstrated a novel attack technique called 'counterfeit policy' that manipulates TypeSafe AI's Jev model, a structured decision-making classifier used for security controls, by injecting a maliciously crafted policy into untrusted input. This technique successfully steers Jev's classification to bypass security checks, such as LangChain's tool-risk gating, by redefining risk criteria within attacker-controlled content. The attack significantly reduces detection rates, dropping recall from 82.90% to 3.88% in prompt injection detection, and enables unauthorized actions to be misclassified as low-risk, demonstrating a critical vulnerability in using such models as security judges without proper input sanitization.

1mo ago · datadog-security-labs

A remote code execution (RCE) vulnerability, tracked as GHSA-632h-h47v-g4x4, was discovered in OpenCode versions 1.14.30 through 1.18.21. The flaw exists in the /global/upgrade API endpoint, where a content-type confusion allows attackers to exploit a code injection vulnerability by submitting a malicious npm package via a cross-origin POST request. The attack can be triggered when a user visits a malicious webpage while running an unsecured OpenCode instance, leading to execution of preinstall scripts from the attacker-controlled package. The vulnerability was patched in OpenCode 1.18.22 by restricting the upgrade target to valid semantic versions and enforcing proper content-type validation.

1mo ago · datadog-security-labs

Datadog Security Research has identified two credential harvesting platforms, Loot and UltraVault, which are used to inventory, validate, and exploit stolen credentials, including API keys for cloud and AI services. The platforms are accessible without authentication and support automated validation and post-exploitation actions, such as re-probing credentials and recommending local privilege escalation exploits. The attacker infrastructure has been observed abusing Amazon Bedrock through API calls like GetCallerIdentity, ListFoundationModels, and InvokeModel, indicating active exploitation of compromised AWS credentials, including both long-term and temporary STS credentials.

2mo ago · datadog-security-labs

The N4D Mesh Controller is an active Linux malware campaign that exploits exposed Model Context Protocol (MCP) servers to enable credential theft, lateral movement, persistence, and command and control. The campaign uses a UPX-packed Go-based agent named 'go-titan' that communicates with controllers via custom headers and supports secondary C2 through Cloudflare Quick Tunnels. The agent targets AI and infrastructure services including Ray Dashboard, LightLLM, PostgreSQL, Redis, Kubernetes, and Jenkins, using automated scanning and exploitation techniques.

2mo ago · datadog-security-labs

Datadog Security Research observed a password spraying campaign from July 24 to August 23, 2026, targeting AWS root user accounts across more than 150 organizations. The attackers used specific Chrome and Firefox user agents and routed traffic through proxy infrastructure with IP addresses flagged as malicious or residential. A key indicator of this campaign is the use of valid root user email addresses, suggesting the attackers either had prior access to such lists or performed brute-force enumeration. No successful authentications were observed, and the motive remains unclear due to the lack of post-compromise activity.

2mo ago · datadog-security-labs

On August 4, 2026, a worm compromised several high-profile npm packages, including keyv, file-entry-cache, and flat-cache, each with around 150 million monthly downloads. The malicious commit (174f6a5) in the keyv package introduced a backdoor designed to propagate to adjacent npm packages, indicating a supply chain attack aimed at widespread distribution. The campaign represents a significant open-source software supply chain compromise with potential for broad impact due to the popularity of the affected packages.

3mo ago · datadog-security-labs

This article details two novel code execution techniques in trusted coding-agent projects that occur after project trust but before the first user prompt, bypassing traditional security controls. In Codex, a malicious project can define a project-scoped Model Context Protocol (MCP) server in .codex/config.toml, causing immediate execution of attacker-controlled processes upon project open. In Claude Code, an attacker can manipulate the PATH environment variable via .claude/settings.json to hijack Git calls and execute a malicious git wrapper script from within the repository. These techniques allow code execution without model interaction or user approval, highlighting the risk of treating project trust as safe.

3mo ago · datadog-security-labs

Recent Linux malware campaigns such as VoidLink, LinkPro, and Atomic Arch leverage eBPF rootkit techniques to evade detection by manipulating kernel-level operations. These rootkits use powerful eBPF helpers like bpf_probe_write_user, bpf_override_return, and bpf_send_signal to hide network connections, suppress enumeration of malicious eBPF programs, and terminate forensic analysis tools. The article highlights that these threats can bypass traditional security tools by tampering with system call outputs and kernel data structures, making early detection at program load time critical.

4mo ago · datadog-security-labs

In June 2026, the threat actor group 'Icarus' conducted a supply chain attack by compromising Klue's backend systems, leveraging dormant OAuth credentials to gain unauthorized access to customer Salesforce and Gong environments. The actor exfiltrated sensitive CRM data including business contacts, price quotes, and sales communications by abusing API queries with stolen OAuth tokens. Klue responded by revoking access and alerting customers, while the actor initiated an extortion campaign using Session Messenger. The attack highlights risks associated with third-party integrations and improper credential lifecycle management.

4mo ago · datadog-security-labs

Threat actors are targeting Salesforce environments by exploiting compromised credentials, OAuth tokens, and misconfigured guest accounts to gain unauthorized access. They perform reconnaissance by querying API endpoints to enumerate resources, discover data objects, and assess API usage limits. This activity is often followed by data enumeration and potential exfiltration, leveraging legitimate authentication mechanisms to blend in with normal traffic. Attackers may use brute-force techniques against weak MFA methods or socially engineer users to approve malicious connected apps.

4mo ago · datadog-security-labs

This article demonstrates a cross-tenant compromise scenario involving Entra agent identities, where an attacker compromises a privileged agent blueprint in one tenant and leverages it to gain unauthorized access to agent identities in another tenant. The attacker adds a credential to a third-party blueprint called 'People Team Agents' and uses it to authenticate as a high-privilege agent, 'Temporary Access Agent', in a subsidiary tenant. This agent has permissions to read user details and reset passwords via Microsoft Graph, which the attacker abuses to set a temporary access pass (TAP) for a Global Administrator account, achieving full compromise of the subsidiary tenant. The attack highlights the risks of trusting third-party agent blueprints with broad permissions across multiple tenants.

4mo ago · datadog-security-labs

Between June 16 and 19, 2026, a phishing campaign targeted AWS users using adversary-in-the-middle (AiTM) techniques to steal console credentials and multi-factor authentication (MFA) codes in real time. The attackers used domains impersonating AWS and SendGrid, hosted on Cloudflare, and delivered phishing emails through legitimate platforms like SendGrid to improve deliverability. The campaign employed a targeted approach with personalized URLs containing encrypted email identifiers, primarily aimed at US-based software engineers and engineering leadership.

4mo ago · datadog-security-labs

GuardDog 3.0 is an open-source security tool designed to detect malicious PyPI and npm packages by analyzing source code for suspicious behaviors. It introduces a new risk scoring engine that evaluates the likelihood of a package being malicious based on attack chain completeness, capability detection, and code sophistication. The tool now uses YARA for more efficient and scalable scanning, replacing Semgrep, and includes built-in sandboxing via nono-py to prevent exploitation during analysis. This release emphasizes improved accuracy, reduced false positives, and defense-in-depth against vulnerabilities in the scanner itself.

4mo ago · datadog-security-labs

The article outlines four new incident response scenarios featured in the Datadog expansion pack of the Backdoors & Breaches card game, designed to simulate real-world cyber threats. These scenarios reflect current trends such as supply chain compromises, cloud credential exposure, AI application vulnerabilities, and CI/CD pipeline attacks. Each scenario demonstrates attacker tactics across initial access, escalation, command and control, exfiltration, and persistence. The purpose is to train teams in detecting and responding to modern cloud and software supply chain threats.

3mo ago · datadog-security-labs

This article discusses the risks associated with Entra agent identities and blueprints, focusing on how compromised or over-privileged agent identities can lead to cross-tenant compromises. It emphasizes securing agent blueprints by restricting high-risk permissions, avoiding the use of secrets, and monitoring for suspicious activity. The guidance includes protective measures, detection strategies, and response steps for compromised agent identities within an Entra ID environment.

3mo ago · datadog-security-labs

Datadog Security Research has observed coordinated campaigns abusing GitHub API to enumerate corporate organizations, repositories, and user accounts. Attackers use ghost accounts, compromised tokens, and custom scraping tools with legitimate-sounding user agents to gather public data and, in some cases, access private repositories. The activity includes reconnaissance via GraphQL and REST endpoints, with rare instances of confirmed data exfiltration. Detection is challenging due to legitimate-looking traffic, but indicators such as suspicious user agents and token types can help identify malicious behavior.

3mo ago · datadog-security-labs

On July 8, 2026, a malicious version (1.20.21) of the npm package @injectivelabs/sdk-ts was published, containing a backdoored module that exfiltrated cryptocurrency wallet mnemonic phrases and private keys. The compromise occurred via a suspicious GitHub commit pushed directly to the main branch, originating from an unfamiliar timezone for the maintainer. Sensitive data was captured during wallet loading and sent via the X-Request-Id HTTP header to a malicious domain designed to mimic a legitimate Injective testnet service. The package was compromised for approximately 49 minutes before being reverted and replaced with a clean version.

3mo ago · datadog-security-labs

A supply-chain attack compromised four popular npm packages under the @asyncapi namespace, affecting over 3 million weekly downloads. The attacker exploited a vulnerable CI pipeline via a malicious pull request to steal credentials for the asyncapi-bot GitHub account, then injected malicious code into the packages. The payloads exfiltrate developer credentials and persist via IDE configuration hooks, leveraging decentralized C2 infrastructure including IPFS and Nostr for resilience.