Cyber Threat Brief — Issue #005

On May 11, 2026, TeamPCP launched the fourth and most technically sophisticated wave of its Mini Shai-Hulud supply chain campaign, compromising over 170 packages across npm and PyPI — the two largest open-source software package registries, where developers publish and download code — in a five-hour window. The campaign hit @tanstack/react-router, a React routing library with over 12 million weekly downloads, alongside 65 UiPath packages, Mistral AI's Python SDK, the OpenSearch JavaScript client, and Guardrails AI. What makes this wave historically significant is what it achieved. The attacker published malicious packages carrying valid provenance certificates — verifiable records stating exactly where, when, and how a software package was built, and by which trusted system. These certificates exist specifically to prove a package is what it claims to be. TeamPCP didn't steal login credentials. They hijacked TanStack's legitimate automated GitHub release pipeline using a chained three-vulnerability attack, then used the pipeline's own trusted identity to publish malware that carries the same cryptographic proof of legitimacy as a real release — making it indistinguishable from the real thing by any standard security check. Stolen credentials are being exfiltrated via three redundant channels — a lookalike domain designed to appear legitimate, the Session decentralized messenger network, and GitHub itself — where stolen data is quietly deposited into repositories and retrieved later, traffic that blends in with normal developer activity and is rarely blocked. The worm self-propagates by stealing the automated identity credentials of any pipeline that installed a compromised version and using them to infect additional packages.

Google's Threat Intelligence Group confirmed on May 11, 2026 that it identified the first real-world zero-day exploit developed with the assistance of artificial intelligence. A prominent cybercrime group with a documented history of mass exploitation campaigns used an AI model to discover a logic flaw in a widely deployed open-source web administration tool — a hardcoded exception in the authentication flow that allowed attackers to bypass two-factor authentication (2FA) using valid user credentials. Google identified the AI involvement through telltale signs in the exploit code: explanatory comments written in a teaching style, an incorrect severity rating that appeared to be hallucinated, and an unusually clean and structured codebase inconsistent with how human attackers typically write exploits. Google's Threat Intelligence Group worked with the vendor to patch the vulnerability before the planned mass exploitation campaign launched, likely disrupting the operation. Google confirmed neither Gemini nor Anthropic's Mythos was the AI model used. The same report documented North Korean group APT45 sending thousands of repetitive prompts to AI models to systematically analyze known vulnerabilities and validate working exploits at scale — a research workload that would be impractical to sustain without AI assistance.

A memory corruption flaw in Exim — the open-source mail transfer agent running on an estimated 56% of internet-facing mail servers worldwide — was disclosed on May 12, 2026. Tracked as CVE-2026-45185 and nicknamed Dead.Letter, the flaw is triggered by a specific sequence of connection events during email transfer that causes the server's memory to become corrupted in a way an attacker can control. The result is remote code execution — the ability for an attacker to run any command on the mail server with no prior access required. Exim has a documented and severe history of rapid exploitation after disclosure — a prior critical Exim flaw was actively exploited within days and remains in CISA's catalog of actively exploited vulnerabilities years later. Dead.Letter was disclosed with a patch available, but given Exim's slow patch adoption rate across the millions of servers running it globally, the exploitation window is expected to be significant.