A (0:01)

A self replicating worm spreads through developer packages. Filefix Phish hides with steganography. The city of Yellowknife is hit by a cybersecurity incident and Microsoft patches one flaw and creates another. This is cybersecurity today. I'm your host Jim Love. A worm that researchers are calling the shy Hulud, named after the famous sand worms in Frank Herbert's Dune. But it's not the size of these worms that does the damage, it's how they spread. It's already been found in over 187 JavaScript libraries. On npm. It spreads when a developer installs an infected package. Then the worm looks for an NPM publish token on their machine. If it finds one, it uses that token to inject itself in up to 20 of the most popular packages the developer can publish to. Then it automatically publishes Trojanized updates. Among the victims were packages maintained by CrowdStrike. About 25 of their npm packages were Trojanized, although CrowdStrike said its main Falcon sensor was not compromised and that the affected packages were removed and keys were rotated. The worm spreads by abusing automation and developer tokens rather than exploiting a library bug, which makes it especially pernicious. Once it lands in a developer environment, it can quickly jump into many projects. This is a supply chain multiplier. It weaponizes trusted developer workflows and package publishing the very automation teams rely on to move fast. Practical responses are straightforward but painful. You rotate any exposed tokens, you narrow token permissions, you enforce human checks before publishing. And you isolate, build and publish credentials from development machines with two factor authentication. The activity looks quieter now, but supply chain worms are designed to lie dormant and erupt. So treat this as a reminder. Developer tokens are not a convenience. They're your crown jewels. It's called steganography. I had to look it up, I admit it. One of those words that you think you know what it means, but you don't use it very often. It's the practice of concealing the very existence of a hidden message by embedding it within another ordinary object or file, such as an image, video or audio file. And it's at the heart of this story. Picture this. Your user encounters a convincing support page. It tells them their meta account will be suspended unless they review an incident report. Victims are asked to copy what looks like a file path and paste it into Windows File Explorer. But the clipboard actually contains a powershell command that runs locally, and it's well hidden. With a simple trick, the attackers append a long variable stuffed with spaces so that the only file path that appears in the address bar looks great. It hides the malicious command from a quick glance, and when the command runs, it downloads a JPEG from BitBucket and the image conceals a second stage script and encrypted payloads using steganography. The chain decrypts and loads payloads in memory using RC4 +Gzip streams XOR encoded URLs and fragmented variables specifically to frustrate signature scanners. The final dropper is Steal C, a Go based info that performs VM sandbox checks and harvests browser cookies and logins, discord and telegram credentials, cloud keys, crypto wallets, VPN tokens, and even screenshots. Because much of the unpacking happens in memory and the image looks benign, this campaign sidesteps many basic detections. What can you do? Well, Never paste text from a web page into an OS dialog or file explorer. Block or alert PowerShell command spawned as children on a browser. What to do? Well Never paste from a web page into a OS dialog or file explorer. You can Block or alert PowerShell commands spawned as children of a browser. You can monitor or quarantine images downloaded by automated scripts. In this case, the JPEG is the delivery vehicle, but old ideas are being recombined into quieter, harder to detect chains. Actors are iterating and the lull we see now may be them just testing this. So far from reports, this hasn't done much damage. But old ideas are being recombined into quieter, harder to detect chains, and the actors just might be iterating. The lull we see right now could be them just testing this. I've done my best research to give people some ideas of how to handle this. If you have suggestions as well, send them to me. You can get my contact information at the end of the podcast. The city of Yellowknife in the Yukon is responding to a cybersecurity incident that has taken down municipal email, online services, including their virtual city hall and card payments at some city facilities. The outage began over the weekend, and officials say they've activated their incident response plan and engaged outside experts. At the time of the reporting, the city said there was no evidence of stolen data, but services remain limited. Public library computer access is offline, lending is restricted, and residents are being asked to use cash or delay payments until systems are restored. City officials say protecting sensitive information is the priority and that regular updates will follow. I don't know if you know Yellowknife or the Yukon, but it's a small municipality and they often run lean IT operations with limited budgets for resilience, which makes them attractive targets when local services go offline. The impact is immediate and practical. There are tremendous spaces and remote services are really important in the north. From blocked payments to halted permits, recovery can be slow. This is a reminder that cyber hygiene and incident readiness are civic necessities. Municipal services and risks affect our everyday life. They're not just data breaches on paper or on a podcast. It's also a reminder to senior levels of government. You've got to take action to help these smaller municipalities, be they in Canada, the U.S. or anywhere. The municipalities may be the rock face, but the senior levels of government have to step up and help them. You can't just sit back and say sucks to be them. You've got to step up. If not, it's on you. September's Windows 11 update has introduced CVE2025 53136, a flaw that exposes kernel memory addresses in Windows 1124H2 builds and in Windows Server 2022. That disclosure weakens kernel address space layout randomization, CASLR1 of Windows Core mitigations, and with addresses leaked, attackers have an easier time turning other bugs into full compromises. Microsoft has acknowledged the issue and says a fix is forthcoming. Until then, administrators are left to tighten monitoring and detection around kernel level activity and to prioritize defensive telemetry. This is another fix. One break, one moment. The patch push to repair other problems has itself exposed new risk for defenders. The only immediate option is vigilance, more logging, stricter telemetry, and readiness to roll out and reconfigure updates if necessary. That's our show today. You can reach me with tips, comments, and even some constructive criticism. Just go to technewsday.com or CA. Use the contact Us page. Let me know what you're thinking. I'm your host Jim Love. Thanks for listening.