Morning Review in IT Security — August 22, 2026

Today's threat landscape reflects a concerning convergence of supply chain vulnerabilities, cloud credential exposure, and sophisticated social engineering campaigns targeting enterprise environments. From trojanized open-source packages delivering AI-powered backdoors to thousands of exposed AWS keys still granting full account access, organizations face mounting pressure to strengthen their dependency management and credential hygiene practices.

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Cybersecurity researchers have identified a significant supply chain attack involving fourteen trojanized npm packages designed to masquerade as legitimate calendar and streak utilities. These malicious packages deliver RedC2 4.0, an artificial intelligence-powered Linux implant that executes as a detached background process once the module loads. The attack demonstrates the evolving sophistication of open-source ecosystem threats, where attackers bundle executable binaries within npm packages to establish persistent backdoor access on compromised systems. Source: The Hacker News

Hundreds of Leaked AWS Keys Give Full Control Over Corporate Accounts

More than 9,300 Amazon Web Services access keys that were publicly exposed between August 2022 and August 2026 remain active and valid, presenting an ongoing critical risk to corporate cloud environments. These leaked credentials grant attackers full control over affected AWS accounts, enabling unauthorized access to sensitive data, infrastructure modifications, and potential lateral movement within organizational networks. The persistence of these credentials underscores the importance of regular key rotation, automated detection of exposed credentials, and continuous monitoring of AWS account activity. Source: Bleeping Computer

Apollo Discloses Data Breach From Ongoing Wave of Attacks Hitting Financial Sector

The private equity firm Apollo has disclosed a data breach resulting from a coordinated attack campaign targeting the financial sector. Attackers successfully compromised Apollo's cloud platforms during a five-day period in early July, gaining access to sensitive personal data belonging to clients and stakeholders. This incident reflects a broader pattern of threat actors targeting financial institutions through cloud infrastructure vulnerabilities and social engineering tactics, emphasizing the need for enhanced cloud security posture and employee awareness training across the sector. Source: CyberScoop

New SynkLoader Malware Pushed in Microsoft Teams Phishing Campaign

A previously undocumented malware family designated SynkLoader is actively being distributed through Microsoft Teams phishing campaigns, leveraging fake lock screen overlays to harvest user credentials. This attack vector exploits the widespread use of Microsoft Teams in enterprise environments, where employees may lower their guard when interacting with what appears to be legitimate IT support communications. The malware's deployment through a trusted collaboration platform demonstrates attackers' continued focus on abusing legitimate business tools to bypass security awareness and technical controls. Source: Bleeping Computer

PHP and Composer Support Now in Beta

Socket has advanced its PHP and Composer security capabilities from experimental status to beta availability for all customers, introducing comprehensive dependency analysis and vulnerability detection for the PHP ecosystem. The platform now provides software bill of materials generation, transitive dependency tracking, CVE detection, and AI-powered malicious package behavior analysis across Packagist repositories. Socket's threat research team has identified multiple attack campaigns migrating from npm to PHP, including the Mini Shai-Hulud malware that abused Composer plugin execution to steal cloud and CI/CD credentials, along with trojanized Laravel utilities and CMS theme packages deploying remote access trojans and malicious jQuery libraries. The addition of PHP reachability analysis, now generally available for Team plan customers and above, enables organizations to distinguish between vulnerabilities that pose genuine risk and those that cannot be reached from application code, potentially eliminating up to ninety percent of false positives. Source: Socket

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a critical technique allowing attackers to weaponize Microsoft Defender's legitimately signed boot-time remediation driver, BTR.sys, to perform arbitrary kernel-level file and registry operations across Windows systems from Windows 7 through Windows 11 25H2. This approach requires no software vulnerability exploitation and no external driver installation, instead abusing the trusted boot-time removal tool to disable security software and modify system configurations at the kernel level. The technique represents a significant threat to endpoint security architectures that rely on boot-time driver protections, as attackers can leverage Microsoft's own signed code to circumvent security measures. Source: The Hacker News

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Kaspersky researchers have identified a new malware family specifically engineered to compromise Android-based vehicle head unit firmware developed by DoFun. The malware propagates through the built-in updater mechanisms of these automotive systems, establishing a multi-stage downloader infrastructure that enables ad fraud operations and proxy botnet deployment. This attack demonstrates the expanding threat surface in connected vehicle ecosystems, where legitimate update mechanisms become vectors for malware distribution, potentially affecting thousands of vehicles deployed in the field. Source: The Hacker News

In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug

Additional security developments warrant attention this week, including a Threema DDoS attack, the emergence of the Evooo1Bot Linux botnet, and Crypto4A's achievement of top-tier NIST certification. T-Mobile's decision to physically cut network cables to prevent unauthorized access highlights the lengths organizations must go to contain active intrusions, while GitHub's denial that artificial intelligence contributed to a recent bug underscores ongoing debates about AI-assisted development security. These incidents collectively illustrate the diverse threat landscape organizations face, from unpatched systems exploited through CVE-2025-62593 to active botnet campaigns and ransomware variants including Medusa and RondoDox. Source: SecurityWeek

As the threat landscape continues to evolve, organizations must prioritize comprehensive dependency management across all package ecosystems, implement aggressive credential rotation and monitoring for cloud environments, and maintain heightened vigilance against social engineering campaigns targeting collaboration platforms. The convergence of supply chain attacks, cloud security breaches, and weaponization of legitimate system tools underscores the critical importance of defense-in-depth strategies and continuous security awareness across technical and human layers.