LeakBase Admin Arrested in Russia Over Massive Stolen Credential Marketplace
2026-03-26T07:24:09Z•b61634aed42a482866476a553e6f3d794f9c1d5e247429e5694b3528ba6d956a
BYOVDbrowser_extensioncanisterwormcitrixcredential_theftdevice_code_phishingdockerglasswormhw audkillerinfostealerlitellmmalwarenpm_malwareoauth_abuseoraclephishingquest_kaceransomwareratscreenconnectsolana_dead_dropstoatwaffle_vs_code_attack_vectors_ai_agentsupply_chainteampcptrivy
What happened
This collection highlights a surge in high-impact activity across supply-chain compromises, actively exploited critical vulnerabilities, large-scale credential/phishing campaigns, and novel malware delivery techniques. Notable incidents include TeamPCP backdooring Python package litellm and multiple GitHub Actions (Trivy-linked supply-chain attacks), a self-propagating CanisterWorm affecting npm packages and Docker images, and GlassWorm using Solana dead-drop artifacts to deliver a RAT and browser-extension info-stealer. Multiple high-severity/actively exploited vulnerabilities are called out—
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- b61634aed42a482866476a553e6f3d794f9c1d5e247429e5694b3528ba6d956a
- Enrichment time
- 2026-03-26T07:24:09Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.