Danger of Libredtail [Guest Diary], (Wed, Apr 29th)
2026-04-30T01:23:53Z•75dc74d35e8754d0b225d20e3ea7e03991eee51813784adc0005df7cca403d80
BitwardenCheckmarx-KICSPyPISANDCLOCKTeamPCPUNC6780apple-patchcanisterSprawlcredential-thefthoneypotlibredtailnpm-wormreconnaissancesupply-chainx-vercel-set-bypass-cookie
What happened
Collection of SANS ISC diary entries (Apr 22–30, 2026) describing active reconnaissance and supply‑chain activity and a recent Apple patch. Highlights: a guest diary warning about Libredtail; multiple honeypot hits showing odd web requests and requests containing an X-Vercel-Set-Bypass-Cookie header (recon/interaction); a TeamPCP supply‑chain campaign update describing three concurrent compromises (Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI), identification of a CanisterSprawl npm worm, and ties to credential theft operations (Google designation UNC6780 / SANDCLOCK) with mention of
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 75dc74d35e8754d0b225d20e3ea7e03991eee51813784adc0005df7cca403d80
- Enrichment time
- 2026-04-30T01:23:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.