Do not get high(jacked) off your own supply (chain)

Cisco Talos published a set of reports and analyses covering a surge in supply chain attacks and related threats. Key items include an Axios NPM supply-chain incident analysis, disclosure of a large-scale automated credential harvesting campaign tracked as UAT-10608 (using the “NEXUS Listener” framework), an in-depth Qilin ransomware write-up focusing on a malicious msimg32.dll EDR-killer infection chain, and vendor vulnerability disclosures (TP-Link, Canva, HikVision) that have been patched. Talos also highlighted broader trends: identity/credential abuse (including BEC), ransomware operators