Tali Ash retweeted
Trust Wallet's Chrome extension was compromised on Christmas Eve. $7M drained.
We dug into the code. The attack was worse than reported - it triggered on every unlock, not just seed phrase imports.
Full technical breakdown:
koi.ai/blog/trust-wallet-binโฆ
#TrustWallet
Tali Ash retweeted
๐จ ๐ช๐ฒ'๐๐ฒ ๐๐ป๐ฐ๐ผ๐๐ฒ๐ฟ๐ฒ๐ฑ ๐๐ต๐ฒ ๐ณ๐ถ๐ฟ๐๐ ๐บ๐ฎ๐น๐ถ๐ฐ๐ถ๐ผ๐๐ ๐ ๐๐ฃ ๐๐ฒ๐ฟ๐๐ฒ๐ฟ ๐ถ๐ป ๐๐ต๐ฒ ๐๐ถ๐น๐ฑ.
It was only a matter of time. The postmark-mcp npm package (1,500+ weekly downloads) has been backdoored since v1.0.16 - silently BCCing every email to the attacker's server.
The developer built trust through 15 legitimate versions, then added one line of code that compromised everyone. When confronted, they deleted the package to cover tracks, but existing installations are still actively leaking emails.
If you're using postmark-mcp, uninstall it NOW.
This is what happens when we give anonymous developers god-mode access to our AI assistants with zero security controls.
Tali Ash retweeted
๐จ ๐๐ฅ๐๐๐๐๐ก๐: ๐ข๐ป๐ด๐ผ๐ถ๐ป๐ด ๐ป๐ฝ๐บ ๐๐๐ฝ๐ฝ๐น๐ ๐ฐ๐ต๐ฎ๐ถ๐ป ๐ฎ๐๐๐ฎ๐ฐ๐ธ
Hundreds of packages compromised โ millions at risk.
โ ๏ธ Malware drops ๐ฏ๐๐ป๐ฑ๐น๐ฒ.๐ท๐, steals secrets w/ ๐ง๐ฟ๐๐ณ๐ณ๐น๐ฒ๐๐ผ๐ด, writes rogue ๐๐ถ๐๐๐๐ฏ ๐๐ฐ๐๐ถ๐ผ๐ป๐, spreads in ๐ฟ๐ฒ๐ฎ๐น ๐๐ถ๐บ๐ฒ.
๐ฆ Notable: @๐ฐ๐๐ฟ๐น/๐๐ถ๐ป๐๐ฐ๐ผ๐น๐ผ๐ฟ, ๐ป๐ด๐
-๐๐ผ๐ฎ๐๐๐ฟ, ๐ธ๐ผ๐ฎ๐ฎ-๐๐๐ฎ๐ด๐ด๐ฒ๐ฟ-๐๐ถ, CrowdStrike pkgs.
๐ ๐๐ถ๐๐ฒ ๐๐ฟ๐ฎ๐ฐ๐ธ๐ฒ๐ฟ โ
koi.security/blog/shai-huludโฆ
#npm #infosec #supplychain #nodejs
Tali Ash retweeted
๐จ Using Axiom for trading? A new Firefox extension is targeting you.
It claims "100% local execution"
Reality? It steals your credentials + wallet info, sends them to a remote server, and hides behind obfuscation and anti-detection.
Always verify in Koidex
ID: axiomtool
Vital work. This is exactly why supply-chain security matters.
๐จ Marketplace Takeover: Millions at Risk ๐จ
Today, weโre lifting the embargo on one of the most critical supply-chain vulnerabilities weโve ever seen.
Our team at Koi Security discovered a flaw in Open-VSX - the open extension marketplace used by over 8 million developers across VSCode forks like @cursor_ai , @windsurf_ai , Firebase Studio, and many more.
Through a misconfigured CI workflow, a malicious actor could silently overwrite every extension in the marketplace. Full control over millions of dev machines.
This was a SolarWinds-class risk for developer tooling.
We responsibly disclosed the bug in May, worked closely with the Eclipse Foundation on the fix, and today weโre sharing the full write-up โ because the ecosystem deserves transparency and protection.
Tali Ash retweeted
Imagine being an American post 9/11, but instead of mourning your people you are busy convincing the world that the twin towers actually existed, that airplains literally crashed into them, that actual people were jumping down. This is how I feel wandering around here these days
Tali Ash retweeted
His name is Tarek Abu-Arar, an Arab Muslim Israeli doctor. On a Saturday morning, he was driving to his hospital shift when he suddenly came across a person lying by the roadside. When he got out of the car and approached to help, that person shot Tarek. He was a Hamas terrorist.
Suddenly, ten more terrorists emerged from the bushes, taking him at gunpoint as a hostage while continuing to shoot at passing cars and kill civilians. When the military forces arrived, the fucking terrorists used Tarek as their human shield, all while he bled profusely and prayed in Arabic for mercy. Throughout this nightmare, the terrorists knew Tarek was an Arab, they knew he was a Muslim, and they simply didn't care.
Tarek was eventually rescued and remained alive by a miracle, but many Arab-Israeli lives have been taken by Hamas on that tragic day. To Hamas, it doesn't matter if you're Muslim or Jewish; their only faith is in murder. Please share #HamasisISIS
Tali Ash retweeted
Heartbroken by the horrific terrorist attacks on Israel and the escalating conflict. My deepest condolences are with all those killed and impacted. Our focus remains on ensuring the safety of our employees and their families. Below is a message we shared with Microsoft employees today about our response. blogs.microsoft.com/blog/202โฆ
Tali Ash retweeted
Join me as I deliver remarks on the terrorist attacks in Israel. teapaw.org/i/broadcasts/1nAJEamABโฆ
Tali Ash retweeted
Imagine the worst things possible that can be done to humans.
Hamas did all of that and more to Israeli civilians. Babies beheaded. People burned alive in their homes. Women raped and dragged through the streets.
Donโt look away.
Respond to threats in near real-time with custom detections, now in Microsoft 365 Defender
aka.ms/AAjy3k8
#ThreatHunting #cybersecurity #IncidentResponse #XDR
Use the new query resources report in Microsoft 365 Defender to help you optimize your hunting performance!
aka.ms/AAizwma
#ThreatHunting #XDR #cybersecurity #microsoft365defender
Sometimes dreams come true - you can hunt in M365D without KQL! Try out our new query builder๐ซ
I'm excited about this one ๐ Hunt in Microsoft 365 Defender without KQL! Our new query builder is now in public preview
techcommunity.microsoft.com/โฆ thanks @Taliash1
Tali Ash retweeted
#AdvancedHunting AADSignInEventsBeta table now includes EndpointCall field which indicates Azure AD endpoint involved in the request (including MFA requests: SAS:BeginAuth, SAS:ProcessAuth, SAS:EndAuth EndpointCalls). Happy hunting! #M365D
Tali Ash retweeted
This video demonstrates ways you can optimize Kusto Query Language
youtube.com/watch?v=ceYvRuPpโฆ
ALT Optimizing your KQL queries in Microsoft 365 Defender advanced hunting feature
Tali Ash retweeted
๐คLook what's here: Defender News!!! aka.ms/DefenderNews Our first monthly blog post, summarizing what happened in the Defender world in the past month. If you like it, we keep it! #m365d #defender #news #xdr #infosec #cybersecurity
You can now hunt for URL clicks data! All details ๐๐พ aka.ms/AAgsa0q
#CyberSecurity #ThreatHunting #m365d #XDR