Security Boulevard

What Makes Non-Human Identity Security Protocols So Crucial? Where increasingly reliant on machine interactions, a critical question emerges for cybersecurity professionals: how do we secure these digital entities known as Non-Human Identities (NHIs)? With cyber threats becoming more sophisticated, the task of managing NHIs in cloud environments takes on unprecedented importance. This discussion uncovers why […]

The post How assured are the security protocols for NHIs appeared first on Entro.

The post How assured are the security protocols for NHIs appeared first on Security Boulevard.

Author, Creator & Presenter: Joshua Saxe, Al Security Technical Lead, Meta

Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations') YouTube Channel.

Permalink

The post [un]prompted 2026 – The Hard Part Isn’t Building The Agent: Measuring Effectiveness appeared first on Security Boulevard.

Author, Creator & Presenter: Jeffrey Zhang, Security Engineer, Stripe & Siddh Shah, Software Engineer, Stripe

Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations') YouTube Channel.

Permalink

The post [un]prompted 2026 – Guardrails Beyond Vibes appeared first on Security Boulevard.

What happened New Progress ShareFile bugs could let attackers take over exposed on-premises servers without logging in by chaining an authentication bypass with remote code execution. The issues affect customer-managed ShareFile Storage Zones Controller 5.x deployments. The first flaw, CVE-2026-2699, is an authentication bypass on the Admin.aspx configuration page that can expose restricted admin functionality […]

The post New Progress ShareFile Bugs Let Attackers Take Over Servers Without Logging In appeared first on CISO Whisperer.

The post New Progress ShareFile Bugs Let Attackers Take Over Servers Without Logging In appeared first on Security Boulevard.

What happened Hackers are weaponizing the leaked Claude Code source to spread Vidar and GhostSocks malware through malicious repositories that impersonate the exposed codebase. The campaign followed Anthropic’s March 31 packaging error, which exposed the source code for Claude Code in a public npm package through a JavaScript source map file containing more than half […]

The post Hackers Spread Vidar and GhostSocks Malware Through Claude Code Leak appeared first on CISO Whisperer.

The post Hackers Spread Vidar and GhostSocks Malware Through Claude Code Leak appeared first on Security Boulevard.

California’s artificial intelligence industry includes security leaders working across frontier model development, enterprise AI platforms, data infrastructure, observability, and AI-native software products. The executives in this feature bring experience from high-growth startups, major technology companies, cloud-native environments, offensive security, incident response, compliance, and product security. Their backgrounds reflect how AI security leadership now spans not […]

The post Cybersecurity Leaders to Watch in California’s Artificial Intelligence Industry appeared first on CISO Whisperer.

The post Cybersecurity Leaders to Watch in California’s Artificial Intelligence Industry appeared first on Security Boulevard.

California’s IT and software sectors continue to produce cybersecurity leaders with deep experience across cloud transformation, enterprise risk, product security, compliance, incident response, and large-scale operational leadership. The executives in this feature have led security programs inside software companies, enterprise technology organizations, healthcare systems, fintech businesses, and infrastructure-heavy global enterprises. Their backgrounds reflect the range […]

The post Cybersecurity Leaders to Watch in California’s IT & Software Sectors appeared first on CISO Whisperer.

The post Cybersecurity Leaders to Watch in California’s IT & Software Sectors appeared first on Security Boulevard.

Google recently released important research that moves Q-Day — the day quantum computers will be able to “break the Internet” — up to 2029. How should enterprises secure their systems?

The post Post-Quantum Cryptography: Moving From Awareness to Execution appeared first on Security Boulevard.

Companies invest heavily in DDoS mitigation, yet outages still happen—often at the worst possible moment. The problem is rarely the protection technology, but the unseen gaps between deployment and a real attack, where misconfigurations, false assumptions, and untested scenarios quietly accumulate.  Red Button simulation data shows that 68% of identified faults are severe or critical, […]

The post Why DDoS Mitigation Fails: 5 Gaps That Testing Reveals appeared first on Security Boulevard.

How Are NHIs Revolutionizing Technology Across Industries? What are the unseen forces revolutionizing technological? Non-Human Identities (NHIs) are among the top contenders, silently working behind the scenes to safeguard digital environments. NHIs drive technology innovation by providing security professionals with powerful tools to manage machine identities and their associated secrets. This paradigm shift has become […]

The post How do NHIs drive technology innovation appeared first on Entro.

The post How do NHIs drive technology innovation appeared first on Security Boulevard.

Is Your Organization Prepared to Manage Non-Human Identities Effectively? The rapid surge in digital transformation has fundamentally shifted how organizations across industries operate. When businesses embrace digital innovations, they also face a complex challenge: managing Non-Human Identities (NHIs). These machine identities are critical to maintaining security and operational efficiency, yet they often remain overlooked, creating […]

The post How scalable is Agentic AI for growing businesses appeared first on Entro.

The post How scalable is Agentic AI for growing businesses appeared first on Security Boulevard.

How Can Non-Human Identities Enhance Your Cloud Security? How are organizations safeguarding their systems from the increasing threats posed by cyberattacks? A critical factor is the effective management of Non-Human Identities (NHIs) and Secrets Security. With cybersecurity professionals navigate the complexities of cloud environments, addressing the security gaps between security and R&D teams has become […]

The post Why choosing Agentic AI empowers business leaders appeared first on Entro.

The post Why choosing Agentic AI empowers business leaders appeared first on Security Boulevard.

Dear blog readers,

In my most recent analysis I decided to take
a deeper look inside some of the domains which belong to members of the XSS forum are known to have been used as
malicious software phone back C&C (command and control) domains.

Here's the compilation:

206.su 740d9cd8ea165302aa3cd7e6f198ea4c 23fefvdfmbhty5ouihksdfs.com c2a10312a002ad7de56237d9a419f2f8 adwords-limon.biz 7e2c95f6297d372820df8bea6ec10c42 astfv43kol.com c5d8a48579e8bc4a2ff1ac229d7da4bb auto-key.org 17b35854c20ef15916bb6191d9018f33 bduioronebmemo.in dcdd3063d89e813d72c8312280d21a81 bookdeel.in d4e9c7625f679a432eb4f7ce3e1bf3f8 bsdhveroorihrh.in cfadd31220c21a81abafc39dd0426653 c0p1.com 4ee484759d7484ecf828eff059c5555a c0p1.com a664d2c1fe26cf7c54cc8d926614ced6 caribecunb.com 868e416b34a1ef25e62c3a02a11b624e clfrev.us e562e5fe01744834ff603418d879a240 cnbravard.com 348b2ccf7d90a3c468a94838dce6c801 cpro.moscow 80707d363ee1068c2e14bde81831ef51 crysis5.info 83966b7e9cbe4491a4330ad755fabf3d devilz.co 4e3f1de1b82030db5e1f3f0f2552efd0 elcrazyfrog.com 52598dff416eb8c050ad214ba1728073 flurred.com 5f7fef40dffcab695e74fcdfbe14b84a forestfire.me a9e26a987720d7d7be4d28c635026bbf ggvruxovlbrm.com f2a4ae0cb148e19d5c7dbce2c2be5143 guliverialand.asia 96122bed38044a7670f88e7c0a8f6005 headover.me ad49f064e234b5b6ce584054587cd362 hyperboot.su f358b0fa7c5961a72dfebc2cf26ae4fd ibcbbgggowdg.com 87a52fdccc7ed7f7e6321e795fb5f82f infosearchresults.com 61cf47b9e315441ce20bb92665891103 ituneshack.com ee5b8493d37177b015b3bb65352148d3 jsmarkating.com 46532f5480a0bc454ecfdb9ad1fcecda khardamok.com 8cbadb2055081e2c1cc07f976d4efa27 kinosezon.site d08482bb992c8155471a21260f7c940b lucaname.net 16ca0886d3d23f0270cc11580767edde mashka.in c21b3634644c442266443f4705f802af mastrio87.asia 93059d28724c37f4c416765c9216b038 maxho.ru 7682dfb7d6aea87094aef38ebe1b6458 micyberclub.com 23c5e8bcc617dae7a2bc4eb5af6db3a4 micyberclub.com 9cbf5558a4e1a96870b379ee373c9ce4 mikewaalspro.com e305e5235d3ca837fc74be8d62b9a310 muk1w4.com c06596f157fd0ba8e19c6cf1603f8c3c nt13.net b643cfbd4cc14525f822efa1cc8931d0 parkrosegroup.info dffe9cb91673bd89c01e1e785a5f0da2 phantom-inc.net ede424a41d7162e20d4da906e64edf03 pohery.org 5fcf430d3a1c13cc057c5ed50223efef pufcer.club e31473f9133d5653c7f4d72fd0a3ee2f qvvksmeemfgd.net 99d73f14df11e38419adb789ec5cd2fb re1.ng 04e46b8950cf21638247b0a6eb020161 sapport.co.in f986c08083355731eee26085aa458ddb sapport.in ce246d78c9e7bd15659a403d35c6af9e sapport.nz 96c9f44a47e2bf673e9374a95634d13e sapport.one 0b3f788696398bc65682befaf9ce6d1b sapport.run 04960a815d836dfa31a5aa73ac0d7270 sevencandlestics.com 43b6f97e218f19f34036662a8fe22513 shop-lehonda.biz 6550833d297d7a23aedf4861be5b55f7 stjosephes.in 50e3830b05a1ad30702ea2e47a380d58 subjec.in 0ea6577c855815cc7565779ad5300851 tavel.in 76b62c12dfe881421d99ae7bfcb519be trishulengineer.com 617ad978e603163363ffd31002efeef5 trishulengineer.com 72e057b2f04e5c086e98943cde452a57 updatehost.club 52b1b21d6884d9fceb0280f238a5f9ec virtest.com ad19b74a38b91153676a9fbebb850d7b virtest.com fcfda10cc69563d24480fa83eda67034 webtrafficbuy.net eed4cba281e5bbba4f41258de3948935 whitepanda.info a152df2d10257d7ed724e94f6ce0ba09 x1x2x3.me b967926bd8636a84ded0ce59bd00b7f5 xfalk0n.su 2757b3ec512bcc4809e108756cc9f7f8 zadoya.com dd2b219854080cc010f7350958fbc350

Stay tuned.

The post Sample Malware Phone Back C&C (Command and Control) MD5s From Domains Belonging to XSS Forum Users – A Compilation appeared first on Security Boulevard.

Author, Creator & Presenter: Shruti Datta Gupta, Product Security Engineer, Adobe & Chandrani Mukherjee, Product Security Engineer, Adobe

Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations') YouTube Channel.

Permalink

The post [un]prompted 2026 – Security Guidance as a Service appeared first on Security Boulevard.

What happened A new federal budget proposal would cut hundreds of millions of dollars more from CISA, sharply reducing funding for the agency’s cybersecurity and critical infrastructure work. The fiscal 2027 proposal would reduce CISA’s total by $707 million, according to the budget summary, though another budget document points to a smaller but still significant […]

The post Trump Budget Proposal Would Cut Hundreds of Millions More From CISA appeared first on CISO Whisperer.

The post Trump Budget Proposal Would Cut Hundreds of Millions More From CISA appeared first on Security Boulevard.

The rapid adoption of Generative AI Applications across enterprises has transformed productivity, automation, and decision-making. AI tools now power daily workflows by drafting emails, writing code, and analyzing data. But with this convenience comes a growing risk, unintentional data exposure. Unlike traditional systems, AI tools often process and retain contextual data. If not properly governed, […]

The post Using AI at Work? Here’s How to Avoid Accidentally Leaking Company Data appeared first on Kratikal Blogs.

The post Using AI at Work? Here’s How to Avoid Accidentally Leaking Company Data appeared first on Security Boulevard.

IntroductionThere was a significant increase in software supply chain attacks in March 2026. There were five major software supply-chain attacks that occurred including the Axios NPM package compromise, which has been attributed to a North Korean threat actor. In addition, a hacking group known as TeamPCP was able to compromise Trivy (a vulnerability scanner), KICS (a static analysis tool), LiteLLM (an interface for AI models), and Telnyx (a library for real-time communication features).In this blog, we cover two of these supply chain attacks, which are significant given the scale and popularity of these packages.Axios NPM Package Compromised to Distribute Cross-Platform RATSummaryOn March 30, 2026, security researchers discovered that the widely-used NPM package Axios was compromised through an account takeover attack targeting a lead maintainer. Threat actors bypassed the project's GitHub Actions CI/CD pipeline by compromising the maintainer's NPM account and changing its associated email. The threat actor manually published two malicious versions via NPM CLI.These poisoned releases inject a hidden dependency called [email protected], which executes a postinstall script functioning as a cross-platform Remote Access Trojan (RAT) dropper targeting macOS, Windows, and Linux systems.During execution, the malware contacts command-and-control (C2) infrastructure at sfrclak[.]com to deliver platform-specific payloads, then deletes itself and replaces its package.json with a clean version to evade detection.RecommendationsReview package.json, package-lock.json, and yarn.lock files for [email protected], [email protected], or [email protected]. Remove any compromised packages, clear caches, and reinstall clean ones.Downgrade to [email protected] (for 1.x users) or [email protected] (for 0.x users) and update lockfiles.Search for connections to sfrclak[.]com or 142.11.206[.]73 from developer workstations and CI/CD systems.Use private registry proxies and Software Composition Analysis (SCA) tools to filter and monitor third-party packages.Restrict open-source package consumption on corporate devices and CI systems to enterprise-open source package managers. Use Zscaler Internet Access controls to block access to internet package managers from corporate devices. Use native controls and Zscaler Private App Connectors to block access to internet package managers from CI systems.Apply lockfiles strictly (e.g., package-lock.json, pnpm-lock.yaml) and use npm ci instead of npm install.Reduce dependency surface by auditing and removing unused packages.Apply least privilege principles using scoped, short-lived keys and tokens.Revoke NPM tokens, GitHub PATs, cloud keys, and CI/CD secrets.Enable phishing-resistant multifactor authentication (MFA) on NPM, GitHub, and cloud platforms.Flag abnormal NPM publishes, unexpected GitHub workflow additions, or secret scanner usage in CI.Treat impacted systems as compromised by isolating, scanning, or reimaging them.Update response playbooks for supply chain attacks and run practice drills.Restrict build environments to internal package managers or trusted mirrors, and limit internet access to reduce exfiltration risk.Reinforce the secure handling of tokens and secrets, and train teams on phishing awareness and supply chain security best practices.Enforce a release cooldown period to ensure users can’t check out newly released packages, stopping emerging supply chain attacks.Affected packages and versionsThe following packages are impacted by this compromise.Package VersionAxios1.14.1Axios0.30.4Table 1: Axios package versions impacted by the compromise.How it worksAll NPM packages include a package.json file that declares dependencies. In the compromised version of Axios, the threat actor added a dependency for a malicious package called plain-crypto-js, which included a postinstall script that ran a setup.js script via node.When developers or CI pipelines run npm install [email protected], NPM resolves the dependency tree, downloads [email protected], and runs the postinstall script. Running node setup.js triggers the compromise sequence.Attack chainThe figure below shows the attack chain.Figure 1: Attack chain for the compromised Axios package.TeamPCP Supply Chain Attack Targets LiteLLM on PyPISummarySummaryOn March 26, 2026, a supply chain attack was uncovered targeting LiteLLM, a popular AI infrastructure library hosted on PyPI with roughly 3.4 million downloads per day. Two LiteLLM package versions were found to include malicious code published by a threat group called TeamPCP. TeamPCP has been associated with multiple recent supply chain attacks such as KICS, Telnyx, and an attack on Aqua Security’s Trivy. The impacted package versions of LiteLLM were only available in PyPI for about three hours before they were quarantined.The poisoned LiteLLM packages appear to be part of an attack designed to harvest high-value secrets such as AWS, GCP, and Azure tokens, SSH keys, and Kubernetes credentials, enabling lateral movement and long-term persistence across compromised CI/CD systems and production environments. RecommendationsRotate or revoke all potentially exposed secrets such as PyPI tokens, API keys, SSH keys, and cloud credentials. Remove unused secrets, and restrict access to sensitive stores and configuration files (for example, .env files, SSH keys, and cloud CLI configs) using least-privilege controls and strict filesystem or secret-store permissions.Closely monitor PyPI publishing activity and recent release history, limit and regularly review maintainer access, and enforce MFA for all maintainers. Strengthen dependency integrity by prioritizing review of Git diffs for dependency version changes to spot suspicious modifications, and implement alerting for any unexpected direct or transitive dependency updates. Verify hashes and signatures where supported.Restrict who or what can run builds and publish artifacts, eliminate plaintext secrets in pipelines, and move to secret managers plus short-lived and ephemeral tokens. Add protected branches and tags, mandatory reviews for release workflows, and limit runner and network permissions.Apply least-privilege Identity and Access Management (IAM), tighten Kubernetes Role-Based Access Control (RBAC), and reduce credential exposure paths. Ensure container and runtime policies prevent credential harvesting and restrict workload identity access to only the required resources.Affected versions and deliveryThe following versions of LiteLLM were impacted. Users should upgrade to version 1.82.6 (the last known clean version).VersionDelivery1.82.8This version introduced a .pth file (litellm_init.pth) added to site-packages/. Python automatically executes code within .pth files during startup, meaning the malicious payload triggers on any Python invocation on the host, even if LiteLLM itself is not imported. The .pth file is correctly recorded in the wheel’s RECORD, so pip’s hash verification and other integrity checks still pass because the malicious content was published with legitimate credentials rather than injected afterward.1.82.7This version introduced an obfuscated Base64-encoded payload within proxy_server.py. This payload is designed to execute immediately upon the library being imported.Table 2: LiteLLM package versions affected and their corresponding delivery mechanism.How it worksLiteLLM is a wrapper or proxy for AI models that lets developers call different LLMs using an OpenAI-style API. Since it’s published on PyPI, a developer might download it by installing it for a project with the standard Python package installer, either directly or as part of an automated dependency install. Attack chainThe attack chain for the compromised packages is shown below.Figure 2: Attack chain for compromised LiteLLM packages.ConclusionThese supply chain threats highlight the fragility of the global software supply chain, especially with respect to open source software. ThreatLabz encourages readers to review the recommendations in this blog to help protect against these kinds of threats and minimize their impacts. Zscaler CoverageZscaler has added coverage for the threats associated with these campaigns, ensuring that any attempts to download a compromised package will be detected with the following threat names.For AxiosAdvanced Threat ProtectionJS.Malicious.npmpackagePS.RAT.npmpackagePython.RAT.npmpackageOSX.RAT.npmpackageFor LiteLLMAdvanced Threat ProtectionLiteLLM-ZABTrojan.SKMGPython.Trojan.LiteLLMIndicators Of Compromise (IOCs)For AxiosPackageVersionHashaxios0.30.4e56bafda15a624b60ac967111d227bf8axios1.14.121d2470cae072cf2d027d473d168158cplain-crypto-js4.2.052f3311ceb5495796e9bed22302d79bcplain-crypto-js4.2.1db7f4c82c732e8b107492cae419740ab@shadanai/openclaw2026.3.31-11b8615b9732833b4dd0a3e82326982fa@qqbrowser/openclaw-qbot0.0.130759e597c3cc23c04cd39301bd93fc79fsetup.js-7658962ae060a222c0058cd4e979bfa1osx script-7a9ddef00f69477b96252ca234fcbeebpython script-9663665850cdd8fe12e30a671e5c4e6fpowershell script-04e3073b3cd5c5bfcde6f575ecf6e8c1system.bat-089e2872016f75a5223b5e02c184dfec For LiteLLMFile hashesMD5 HashNamecde4951bee7e28ac8a29d33d34a41ae5litellm_init.pthf5560871f6002982a6a2cc0b3ee739f7proxy_server.py7cac57b2d328bd814009772dd1eda429p.py85ed77a21b88cae721f369fa6b7bbba3LiteLLM v1.82.7 Package2e3a4412a7a487b32c5715167c755d08LiteLLM v1.82.8 PackageNetwork indicators IndicatorTypecheckmarx[.]zoneC2 pollingmodels[.]litellm[.]cloudExfiltration URL 

The post Supply Chain Attacks Surge in March 2026 appeared first on Security Boulevard.

We uncovered two job scams posing as legitimate offers from Coca-Cola and Ferrari that could pry into Google and Facebook accounts.

The post That dream job offer from Coca-Cola or Ferrari? It’s a trap for your passwords appeared first on Security Boulevard.

How Secure is Your Organization’s Approach to Non-Human Identities? Have you ever considered the scale of machine identities within your organization? With the expansive growth of digital, Non-Human Identities (NHIs) are becoming crucial in effective data protection strategies. These machine identities are essentially technological constructs that necessitate vigilance, given their pivotal role in accessing sensitive […]

The post How to protect your data with Agentic AI appeared first on Entro.

The post How to protect your data with Agentic AI appeared first on Security Boulevard.

Have You Ever Considered How Securing Non-Human Identities Could Transform Your Organization? Non-Human Identities (NHIs) security is increasingly crucial across various sectors, from financial services to healthcare and beyond. These machine identities are not mere technical entities but fundamental components that define a company’s cybersecurity. By understanding and managing NHIs effectively, organizations can bridge the […]

The post What makes Non-Human Identities safe for companies appeared first on Entro.

The post What makes Non-Human Identities safe for companies appeared first on Security Boulevard.