HTTP Requests with X-Vercel-Set-Bypass-Cookie Header, (Tue, Apr 28th)
2026-04-28T19:23:52Z•eea66ad66b2f5ee452b4e106d760d72e7dcdc5b5c045e3cee5e58836fc3432b1
BitwardenCanisterSprawlCheckmarx-KICSPyPISANDCLOCKTeamPCPTelegram-tdataUNC6780X-Vercel-Set-Bypass-Cookiecredential-harvestinghoneypotiOSmalwarenotification-servicenpmpatchsupply-chainwavxinference
What happened
SANS ISC diary entries report multiple active threats and observations: honeypot traffic containing an unusual X-Vercel-Set-Bypass-Cookie header; a resumption/escalation of the TeamPCP supply‑chain campaign (three concurrent compromises including Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI) and identification of a CanisterSprawl npm worm; exploitation-aware iOS/iPadOS updates (iOS/iPadOS 26.4.2 and 18.7.8) fixing Notification Services vulnerability CVE-2026-28950; credential‑harvesting via Telegram "tdata" observed in honeypot research; and reports of threat actors delivering code/p
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- eea66ad66b2f5ee452b4e106d760d72e7dcdc5b5c045e3cee5e58836fc3432b1
- Enrichment time
- 2026-04-28T19:23:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.