ISC Stormcast For Tuesday, May 26th, 2026 https://isc.sans.edu/podcastdetail/9944, (Tue, May 26th)
2026-05-26T19:24:02Z•dc85341b1201caeae3341bdb1a569b6859722a28487337f449a4601749ac2c7b
ACR-stealerClaude-impersonationGitHub-compromiseNode.jsTeamPCPlinuxmalware-frameworkmicrosoft-accessnpmphishingproxifierselective-http-proxysha256:049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906dbsoftware-supply-chainstealersupply-chaintrainingtrojanized-python-sdkvbavulnerabilitywireshark-4.6.6
What happened
SANS ISC diary (late May 2026) highlights multiple active threats and notable tooling/patch news: TeamPCP supply‑chain campaign escalated — operating across three package ecosystems, trojanizing an officially Microsoft‑published Python SDK, reaching internal GitHub code, and releasing its own framework on GitHub. Reports of a possible “ACR stealer” delivered from a page impersonating the Claude AI interface (phishing/credential‑stealing vector). Discovery of a cross‑platform Node.js/NPM stealer (SHA256 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9) and discussion of MS‑Acess
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- dc85341b1201caeae3341bdb1a569b6859722a28487337f449a4601749ac2c7b
- Enrichment time
- 2026-05-26T19:24:02Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.