ISC Stormcast For Tuesday, May 26th, 2026 https://isc.sans.edu/podcastdetail/9944, (Tue, May 26th)
2026-05-26T07:23:45Z•ebb94dbf68457ab8477631bf6c6a28288d9043c21365baf3aaa2818d3eb19f6e
TeamPCPaccess-vbaacr-stealerai-impersonationgithubimpersonationmalwarenodejsnpmoffice-vbapatchpythonred-teamsecurity-researchselective-proxystack-stringsstealersupply-chaintrainingtrojanized-sdkvulnerabilitywireshark
What happened
Weekly ISC SANS diary roundup (May 21–26, 2026). Key highlights: TeamPCP supply-chain campaign continues — operating across three package ecosystems, reached GitHub internal code, trojanized an officially Microsoft-published Python SDK, and published its framework on GitHub (significant supply-chain risk). A cross-platform Node.js/NPM stealer was analyzed (obfuscated sample SHA256 noted). A possible ACR stealer was observed on a page impersonating Claude (AI persona). Wireshark 4.6.6 was released fixing one vulnerability and multiple bugs. Additional posts cover Microsoft Access VBA risks, an示
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- ebb94dbf68457ab8477631bf6c6a28288d9043c21365baf3aaa2818d3eb19f6e
- Enrichment time
- 2026-05-26T07:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.