Today's Odd Web Requests, (Wed, Apr 29th)
2026-04-29T13:23:57Z•8dfb00eb0d00e05ba4ec0a97de1ba50a00db8d2549eee6166edef91acf9d3930
BitwardenCanisterSprawlCheckmarx-KICSCiscoPyPISANDCLOCKTeamPCPUNC6780X-Vercel-Set-Bypass-Cookieapplecredential-harvestinghoneypothttp-headersiosnotification-vulnerabilitynpm-wormreconnaissancesupply-chaintdatatelegramxinference
What happened
SANS ISC diary feed noting multiple unrelated but notable security observations: new reconnaissance HTTP requests hitting honeypots (including requests with an X-Vercel-Set-Bypass-Cookie header); a guest diary describing Telegram 'tdata' being used as a credential-harvesting vector; a TeamPCP supply-chain campaign update reporting a 26-day pause ended with three concurrent compromises (Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI), identification of a CanisterSprawl npm worm, and ties to UNC6780 (SANDCLOCK) activity and stolen Cisco source material (also noting a lapsed remediation/f
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 8dfb00eb0d00e05ba4ec0a97de1ba50a00db8d2549eee6166edef91acf9d3930
- Enrichment time
- 2026-04-29T13:23:57Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.