- TeamPCP and Breached forum launched a supply chain attack competition offering a $1,000 Monero prize, with the Shai-Hulud worm already open-sourced and distributed.
- Palo Alto Networks confirmed active exploitation of a critical PAN-OS buffer overflow flaw, while a new GhostLock technique lets low-privileged users lock files without deploying ransomware.
- Fake IT support messages on Microsoft Teams, tokenizer tampering in AI models, and PowerShell payloads disguised as JPEG files dominated a week where attacks hid in plain sight.
Cybercriminals just turned supply chain attacks into a competition. TeamPCP, the threat actor recently linked to the compromise of TanStack’s npm packages, partnered with the Breached forum to announce a $1,000 Monero prize for the biggest supply chain attack, measured by weekly or monthly downloads. The group open-sourced the Shai-Hulud worm and hosted it on the forum’s content delivery network. GitHub removed its copy, but the exposure was already done.
The rules are straightforward: use the worm, compromise a target environment, and submit proof. Smaller packages count too, since the competition adds them up. According to Socket, the contest turns supply chain exploits into a leaderboard-style stunt for low-level actors trading risk for notoriety.
TeamPCP has been pushing the supply chain compromise forward to collect credentials and hand access to groups that know how to monetize it. The group is now offering forum users an open-source worm, a scoring system, and incentives to maximize compromises.
Supply chain fears are also being exploited through phishing. Cybercriminals are using fake ‘out-of-stock’ scams to trick businesses into revealing credentials and installing malware, a different but equally dangerous supply chain threat.
Critical PAN-OS Flaw Draws Emergency Patches
While that competition grabbed headlines, attackers quietly exploited real vulnerabilities elsewhere. Palo Alto Networks confirmed active exploitation of CVE-2026-0300, a critical buffer overflow flaw in the User-ID Authentication Portal service of PAN-OS.
An unverified attacker can give out unique packets to deploy arbitrary code using root privileges. Palo Alto noted that unknown threat actors have used the flaw to drop payloads, including Earthworm and ReverseSocks5, since at least last month. The company released its first round of fixes this week.
Attackers Hide Inside Legitimate Tools and Platforms
Threat actors also spent the week disguising malicious activity as normal operations. Attackers used fake IT support messages on Microsoft Teams to deliver a Python-based ModeloRAT via Dropbox.
The malware established command-and-control, installed backdoors, exploited a Windows flaw for privilege escalation, and used a fake lock screen to capture domain credentials. ReliaQuest attributed the activity to a financially motivated initial access broker tracked as KongTuke.
Operation SilentCanvas reportedly spread a trojanized ConnectWise ScreenConnect via a PowerShell payload hidden as a JPEG file. CYFIRMA said the payload abused user trust and file-extension bypass tricks to hide malicious activity inside legitimate enterprise software. HiddenLayer demonstrated “tokenizer tampering,” where altering a single Hugging Face config file can let attackers manipulate model outputs.
The attack works across multiple model formats and requires no weight modifications or knowledge of the model’s architecture. According to HiddenLayer, a startup-loaded file can be exploited to inject tool calls or hijack model responses.
New GhostLock Technique Mimics Ransomware Without the Malware
GhostLock showed that standard users can indefinitely lock shared files without ransomware or admin privileges. Kim Dvash of Israel Aerospace Industries built the tool to expose the gap.
According to Dvash, abusing a Windows file-creation function can trigger sharing errors that stall ERP systems and workflow queues. The impact looks identical to ransomware encryption, but GhostLock produces none of the signals that detection systems typically watch for.
On a more positive note, Meta announced Incognito Chat for Meta AI in its main app and WhatsApp. CEO Mark Zuckerberg described it as a private AI system that keeps chats inaccessible even to Meta and automatically clears sessions on exit.
The pattern this week maintained simple techniques, trusted tools, and weak checks, doing more damage than complex exploits. Patching known flaws, auditing user privileges, and treating unexpected prompts with suspicion remain the strongest defenses available.
