Axios npm hack used fake Teams error fix to hijack maintainer account
2026-04-05T13:23:51Z•01b38c72e88e73d1c601b4df0eff3a53eabd30cc5d93fba6004cc78f05b5b0ab
BrowserGateDPRKGitHubIP-reputationOAuth2Progress-ShareFileQilinTeamPCPVidarZendeskbrowser-extensionscloud-breachcrypto-exploitdata-breachdevice-code-phishinginfostealernation-statenpmpre-auth-rceprivacyransomwareresidential-proxiessocial-engineeringsupply-chainthird-party-breach
What happened
A broad set of high-impact security incidents and emerging threats were reported: a suspected North Korean social-engineering campaign hijacked an Axios maintainer via a fake Teams “error fix” to compromise the npm supply chain; device-code (OAuth2 Device Authorization Grant) phishing attacks have surged (~37x) with new kits circulating; LinkedIn was accused of covertly scanning visitors’ browsers for 6,000+ Chrome extensions ("BrowserGate"); Progress ShareFile vulnerabilities can be chained to enable pre-authenticated RCE and unauthenticated exfiltration; CERT-EU attributed a European-Commssn
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 01b38c72e88e73d1c601b4df0eff3a53eabd30cc5d93fba6004cc78f05b5b0ab
- Enrichment time
- 2026-04-05T13:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.