Weekly Threat Bulletin – May 20th, 2026

Malware: ACR Stealer, Amatera, AMOS, Atomic macOS Stealer, Atomic Stealer, bw1.js, CANFAIL, CanisterSprawl, CanisterWorm, CipherForce, DripDropper, gh-token-monitor, GlassWorm, GlassWorm v2, GoBear, Gomir, HEUR:Worm.Script.Shulud.gen, js.shai_hulud, LONGSTREAM, mcpAddon.js, mini Shai-Hulud, Mini Shai Hulud, Mini Shai-Hulud, Mini-Shai-Hulud, MorganArg, NFCGate, NGate, PamDOORa, PCPJack, PROMPTSPY, SANDCLOCK, SANDWORM_MODE, sha1-hulud, Sha1-Hulud, SHA1-Hulud, SHA1Hulud, SHA1HULUD, Sha1-Hulud: The Second Coming, Shai-Hulud, Shai Hulud 2.0, Shai-Hulud 2.0, Shai-Hulud 3.0, Shai-Hulud: The Third Coming, Shai-Hulud V2, Shai-Hulud worm, Shulud, Skeleton Key, Sliver, Snow, Snowbasin, SnowBasin, Snowbelt, SnowBelt, Snowglaze, SnowGlaze, TeamPCP cloud stealer, TeamPCP Cloud stealer, TeamPCP Cloud Stealer, TeamPCPCloudStealer, The Golden Path, The Second Coming, Trojan.Skelky, Vect, Vect 2.0, VECT 2.0, VNCSpy, WAVESHAPER, WAVESHAPER.V2, XMRig, ZshBucket, ZshBucket RAT CVEs: CVE-2025-29927, CVE-2025-48703, CVE-2025-55182, CVE-2025-9501, CVE-2026-1357, CVE-2026-25253, CVE-2026-28353, CVE-2026-31431, CVE-2026-33626, CVE-2026-33634, CVE-2026-33825, CVE-2026-35029, CVE-2026-35030, CVE-2026-42208, CVE-2026-42994, CVE-2026-45321 Technologies: 1Password, Aikido Security, Alpine Linux, Amazon IAM, Amazon Web Services, Amazon Web Services (AWS), Amazon Web Services (AWS) CloudFormation, Anthropic Claude, Apache HTTP Server, Apache Maven, Apple macOS, Apple Safari, Aqua Security Trivy, Atomic Wallet, Automagik, AWS CloudFormation, Bitcoin Core, Bitwarden, Brave Browser, Bun, Cardano, Checkmarx, Checkmarx AST, Checkmarx cx-dev-assist, Checkmarx KICS, Checkmarx Visual Studio Code Extension, CircleCI, Claude Code, Cloudflare, Control Web Panel, Debian, DFINITY Internet Computer Protocol, DigitalOcean, Discord, Docker, Docker Hub, Dogecoin, DraftLab, Eclipse Foundation Open VSX Registry, Endor Labs, Ethereum, Exodus Wallet, Falco, Fastly, FreeBSD, Git, GitHub, GitHub Actions, GitHub Container Registry, GitLab, GNU Bash, GNU Privacy Guard, Google Android, Google Chrome, Google Cloud Platform, Google Cloud Platform (GCP), gopass, Guardrails AI, HashiCorp Terraform, HashiCorp Vault, Intercom, Jenkins, Kubernetes, Linux, Litecoin, LiteLLM, LXC, MetaMask, Microsoft 365, Microsoft Azure AI, Microsoft Azure Key Vault, Microsoft Entra ID, Microsoft npm, Microsoft Visual Studio, Microsoft Windows, Mistral AI, MongoDB Server, NGINX, Node.js, npm, Open Container Initiative runC, OpenSearch, OpenSSH, Open VSX Registry, Oracle Java, pass, Phantom, PHP, Podman, PostgreSQL, PyPI, Python, Python Package Index, Python PyPI, Python Software Foundation Python Package Index, PyTorch Lightning, React, Redis, Ripple, SafeDep, Salesforce, SAP Cloud Application Programming Model, SAP Cloud MTA, SAP Multi-Target Application Build Tool, SAP NetWeaver, Sigstore, Socket.IO, Solana, SQLite, Squawk, StepSecurity, systemd, TanStack, Telegram, Telnyx, UiPath, Vercel Next.js, WordPress, Xorbits Xinference, Yandex Browser, Zcash, Zsh Threat Actors: Agwagwagwa, Andariel, APT45, BanishedKitten, Bluenoroff, CipherForce, DeadCatx3, FamousChollima, Kimsuky, Lapsus, LAPSUS$, MegaGame10418, OnyxSleet, PCP, PCPcat, PcPcats, PersyPCP, plghost, Sandworm, SHADOW-WATER-058, ShellForce, ShinyHunters, TeamPCP, TeamTNT, UNC1069, UNC2814, UNC6780, VoidDokkaebi Attacker Countries: Brazil, China, France, Iran, North Korea, Russia, United Kingdom, United States Attacker IPs: 104[.]21[.]17[.]177, 142[.]11[.]206[.]73, 161[.]97[.]129[.]25, 161[.]97[.]135[.]154, 161[.]97[.]163[.]87, 161[.]97[.]186[.]175, 161[.]97[.]187[.]42, 172[.]67[.]177[.]189, 188[.]114[.]96[.]3, 193[.]187[.]129[.]143, 213[.]136[.]80[.]73, 38[.]242[.]204[.]245, 38[.]242[.]237[.]196, 38[.]242[.]245[.]147, 45[.]148[.]10[.]212, 54[.]67[.]2[.]84, 83[.]142[.]209[.]11, 83[.]142[.]209[.]194, 83[.]142[.]209[.]203, 83[.]171[.]249[.]231, 91[.]195[.]240[.]123, 94[.]154[.]172[.]183, 94[.]154[.]172[.]43 Attacker Emails: claude@users[.]noreply[.]github[.]com, email protected, github-actionsbot@users[.]noreply[.]github[.]com, helloworm00@proton[.]me Attacker Domains: api[.]cloud-aws[.]adc-e[.]uk, api[.]github[.]com, api[.]masscan[.]cloud, audit[.]checkmarx[.]cx, cdn[.]cloudfront-js[.]com, checkmarx[.]cx, checkmarx[.]zone, cjn37-uyaaa-aaaac-qgnva-cai[.]raw[.]icp0[.]io, cookiemanager[.]ne[.]kr, drnatashachinn[.]com, evangelia[.]edu, filev2[.]getsession[.]org, generativelanguage[.]googleapis[.]com, *[.]getsession[.]org, getsession[.]org, ghcr[.]io, github[.]com, git-tanstack[.]com, igotnofriendsonlineorirl-imgonnakmslmao[.]skyhanni[.]cloud, lastpass-login-help[.]com, litter[.]catbox[.]moe, models[.]litellm[.]cloud, naverbox[.]pe[.]kr, nidiogln[.]ne[.]kr, pbyi76s0e9[.]execute-api[.]us-east-1[.]amazonaws[.]com, plug-tab-protective-relay[.]trycloudflare[.]com, proton[.]me, ptpb[.]pw, registry[.]npmjs[.]org, safely-irc-weblogs-fewtrycloudflarecom, scan[.]aquasecurtiy[.]org, seed1[.]getsession[.]org, seed2[.]getsession[.]org, seed3[.]getsession[.]org, sfrclak[.]com, spm-cdn-assets-dist-2026[.]s3[.]us-east-2[.]amazonaws[.]com, tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io, telemetry[.]api-monitor[.]com, [.]trycloudflare[.]com, trycloudflare[.]com, updates[.]checkmarx[.]cx, users[.]noreply[.]github[.]com, webhook[.]site, whereisitat[.]lucyatemysuperbox[.]space, wud[.]wuaze[.]com, zero[.]masscan[.]cloud Attacker URLs: 94[.]154[.]172[.]43/v1/telemetry, audit[.]checkmarx[.]cx/v1/telemetry, cjn37-uyaaa-aaaac-qgnva-cai[.]raw[.]icp0[.]io/drop, eucie09111[.]myartsonline[.]com/0502/v.php, generativelanguage[.]googleapis[.]com, github[:]tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c, git-tanstack[.]com[:]443/router, git-tanstack[.]com/tmp/transformers.pyz, hxxps[://]83[.]142[.]209[.]194/transformers.pyz, hxxps[://]api[.]github[.]com/search/commits, hxxps[://]api[.]github[.]com/search/commits?q=beautifulcastle&sort=author-date&order=desc, hxxps[://]api[.]github[.]com/search/commits?q=beautifulcastle+&sort=author-date&order=desc, hxxps[://]api[.]github[.]com/search/commits?q=EveryBoiWeBuildIsAWormyBoi, hxxps[://]api[.]github[.]com/search/commits?q=LongLiveTheResistanceAgainstMachines&sort=author-date&order=desc&per_page=50, hxxps[://]api[.]github[.]com/user, hxxps[://]audit[.]checkmarx[.]cx/v1/telemetry, hxxps[://]github[.]com/checkmarx/ast-github-action, hxxps[://]github[.]com/gruposbftechrecruiter/ghola-slig-531, hxxps[://]github[.]com/gruposbftechrecruiter/siridar-fedaykin-485, hxxps[://]github[.]com/gruposbftechrecruiter/siridar-sietch-57, hxxps[://]github[.]com/gruposbftechrecruiter/siridar-stillsuit-889, hxxps[://]github[.]com/nikra89/mentat-sandworm-98, hxxps[://]github[.]com/nikra89/sayyadina-ornithopter-43, hxxps[://]github[.]com/nikra89/siridar-heighliner-252, hxxps[://]github[.]com/oven-sh/bun/releases/download/bun-v1.2.13/.zip, hxxps[://]github[.]com/SheepTester/hello-world, hxxps[://]github[.]com/Shrenath1903/tleilaxu-cogitor-127, hxxps[://]github[.]com/shrivathsa11/fedaykin-navigator-270, hxxps[://]github[.]com/TanStack/router/actions/runs/25613093674, hxxps[://]github[.]com/TanStack/router/actions/runs/25691781302, hxxps[://]github[.]com/zblgg/configuration, hxxps[://]git-tanstack[.]com, hxxps[://]git-tanstack[.]com/transformers.pyz, hxxps[://]hub[.]docker[.]com/r/checkmarx/kics, hxxps[://]litter[.]catbox[.]moe/7rrc6l.mjs, hxxps[://]litter[.]catbox[.]moe/h8nc9u.js, hxxps[://]marketplace[.]visualstudio[.]com/items?itemName=checkmarx.ast-results, hxxps[://]marketplace[.]visualstudio[.]com/items?itemName=checkmarx.cx-dev-assist, hxxps[://]open-vsx[.]org/extension/checkmarx/ast-results, hxxps[://]open-vsx[.]org/extension/checkmarx/cx-dev-assist, hxxps[://]ourl[.]co/112923, hxxps[://]registry[.]npmjs[.]org/-/npm/v1/oidc/token/exchange/package/%40bitwarden%2Fcli, hxxps[://]seed1[.]getsession[.]org/json_rpc, hxxps[://]seed2[.]getsession[.]org/json_rpc, hxxps[://]seed3[.]getsession[.]org/json_rpc, hxxps[://]tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io/, hxxps[://]tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io/., hxxps[://]zero[.]masscan[.]cloud/v1/telemetry, hxxp[:]//127.0.0.1:8200, hxxp[:]//169.254.169.254, hxxp[:]//169.254.169.254/latest/meta-data/iam/security-credentials/, hxxp[:]//169.254.170.2, hxxp[:]//fd00:ec2::254, hxxp[:]//filev2.getsession.org/file/, hxxps[:]//83.142.209.194/transformers.pyz, hxxps[:]//83.142.209.194/v1/models, hxxps[:]//api.github.com/search/commits?q=beautifulcastle, hxxps[:]//api.github.com/search/commits?q=beautifulcastle%20&sort=author-date&order=desc, hxxps[:]//api.github.com/search/commits?q=beautifulcastle%20&sort=author-date&order=desc, hxxps[:]//api.github.com/search/commits?q=LongLiveTheResistanceAgainstMachines, hxxps[:]//api.github.com/search/commits?q=LongLiveTheResistanceAgainstMachines&sort=author-date&order=desc&per_page=50, hxxps[:]//api.github.com/search/commits?q=LongLiveTheResistanceAgainstMachines&sort=author-date&order=desc&per_page=50, hxxps[:]//api.github.com/search/commits?q=OhNoWhatsGoingOnWithGitHub&sort=author-date&order=desc&per_page=50, hxxps[:]//audit.checkmarx.cx/v1/telemetry, hxxps[:]//cdn.cloudfront-js.com:8443/u, hxxps[:]//github.com/oven-sh/bun/releases/download/bun-v1.3.13/, hxxps[:]//github.com/oven-sh/bun/releases/download/bun-v1.3.13/.zip, hxxps[:]//git-tanstack.com/transformers.pyz, hxxps[:]//litter.catbox.moe/iqesmbhukgd2c7hq.sh, hxxps[:]//spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws.com, hxxps[:]//whereisitat.lucyatemysuperbox.space, hxxps[:]//whereisitat.lucyatemysuperbox.space/, plugins[.]jenkins[.]io/checkmarx-ast-scanner/releases/, registry[.]npmjs[.]org/-/v1/search?text=maintainer:, sfrclak[.]com[:]8000/6202033, telemetry[.]api-monitor[.]com/v1/drop, telemetry[.]api-monitor[.]com/v1/telemetry, webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7 Attacker Hashes: 005587975a483876c1fa26b64b418931019be38f, 00ca0c04d247ef09f2b2acc452029345, 01cebc48016395e284ac76afc1816f143ee3e7b6, 01ff1e56fd59a8fa525d97e670f7f297a1a204331b89b2cd4e36a9abc6419203, 03df1ecd86132e06643d24c856d8976d1b497945, 04d8a99447b16f6839fff3b978f88d7e, 077d49fa708f498969d7cdffe701eb64675baaa4968ded9bd97a4936dd56c21c, 0af7415d65753f6aede8c9c0f39be478666b9c12, 0b86434ca5145636d745222f7e49c903ce6ef538, 12f35b1081b17d21815b35feb57ab03d02482116, 14eb4ce01dd4307759887ff819359b70d7d9ff709ecde039a5abc1aac325b128, 167ce57ef59a32a6a0ef4137785828077879092d7f83ddbc1755d6e69116e0ad, 18f784b3bc9a0bcdcb1a8d7f51bc5f54323fc40cbd874119354ab609bef6e4cb, 1d9e4ece8e13c8eaf94cb858470d1bd8f81bb58f62583552303774fa1579edee, 1e8538c6e0563d50da0f2e097e979ebd5294ce1defe01d0b9fe361ba3bed1898, 2258284d65f63829bd67eaba01ef6f1ada2f593f9bbe41678b2df360bd90d3df, 24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9, 258257560fe2f1c2cc3924eae40718c829085b52ae3436b4e46d2565f6996271, 29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7, 2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50, 2cd2c5268e41cdece1b0506bcda3b9eba2998119, 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96, 2fab324eb0d927846c8744dc0e217beea65138e0, 307d0fa7407d40e67d14e9d5a4c61ac5b4f20431, 339cbf61c80f757085c5afb7304d69f323bdf87a, 35baf8316645372eea40b91d48acb067, 3ddb8967919a801b3c383e58cddceab21138134c6a26560d99e2672e86f36f2a, 3ee893ae46530b92e0d26435fb979d82, 3f3f42d072bd36860ab7bd7fb5e10ac0d22c741c13c89505ccd6ec0ea572eea7, 4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34, 40d0f21b64ec8fb3a7a1959897252e09, 45dc9c02f82b4370ca92785282d43a86, 46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09, 484067fd6232f7cdd7b664b33857fc2c, 4b04304f6d51392e3f43856c94ca95800518a694, 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1, 6060da100b5cd587131a1c11a20d6e0108604744, 619c56acf572df75b6004a6fc013c80900316a76099b241d64312da3a44f10b4, 65bd72fcddaf938cefdf55b3323ad29f649a65d4ddd6aea09afa974dfc7f105d, 65bf499d16a5e8d25ba95d69ec9790a6dd4a1f14, 6bc859aaee1f8885eec2a3016226e877e5adba08, 6f933d00b7d05678eb43c90963a80b8947c4ae6830182f89df31da9f568fea95, 6fb87d243b011b5445f379f80e1a6b4d, 744c9d61b66bcd2bb5474d9afeee6c00bb7e0cd32535781da188b80eb59383e0, 77d92efe7af3547f71fd41d4a884872d66b1be9499eaa637e91eac866911694d, 79ac49eedf774dd4b0cfa308722bc463cfe5885c, 7b0278216ac31ec18eca9eb8bc1c1261a1b26f6c, 7b6a28e92149637e5d7c7f4a2d3e54acd507c929, 7c12d8614c624c70d6dd6fc2ee289332474abaa38f70ebe2cdef064923ca3a9b, 8046a11187c135da6959862ff3846e99ad15462d2ec8a2f77a30ad53ebd5dcf2, 80a3d2877813968ef847ae73b5eeeb70b9435254e74d7f07d8cf4057f0a710ac, 820fa07a7328b6cf2b417078e103721d4d8f2e79, 834b6e5db5710b9308d0598978a0148a9dc832361f1fa0b7ad4343dcceba2812, 848ef1f638807826586802428a7ebafdc710915c, 8605e365edf11160aad517c7d79a3b26b62290e5072ef97b102a01ddbb343f14, 86282ebcd3bebf50f087f2c6b00c62caa667cdcb53558033d85acd39e3d88b41, 87259b0d1d017ad8b8daa7c177c2d9f0940e457f8dd1ab3abab3681e433ca88e, 8cd683f78735c9bfc32600c73d3d9abe, 927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f, 971670c10eff28339a085ca50a600e35, 9b3257e45b27a6bbe4e240e41a3a306f, 9c7ab48c9fdbbeecdad8433529bdab38584f0e25, a1da198bb4e883d077a0e13351bf2c3acdea10497152292e873d79d4f7420211, a20a9924d92c2b06d82b79c0fe87451c650cabec, ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c, b1e4b1f3aad0d489ab0e9208031c67402bbb8480, b523a69b27064d1715d1f0aaffcfae63, bbbca2ddaa5d8feaa63e36b76fdaad77386f024f, bc95cc5dda788295aa0c9456791520599ef99526, c19c4574d09e60636425f9555d3b63e8cb5c9d63ceb1c982c35e5a310c97a839, c2dd8051d89c4efa71bd67d2df7d9b4bc3e67810, c55a10759f6f415a536940a75f42aa372878a51f8eb97468551eabf6d88ae492, c6ce4e25f7fe3e3bb1eea2e9052483bf, ca4a5bb85778ffcd2153ace88fe2d882c8ceeb23, ce7e4199506959fd7a71b64209b2c07b9c82e53a946aa7d78298dc9249230d01, d37874c6c8a2d2a7a252810a1999ece8bb39e9b3ab2b7e8bf40da15bd36a1584, d446803f4c3bc116263faa3499a1d3f95b2825de, d468f16eafccbc54a994f3d675ace8ae, dbb9b09957113463bbeb420c2c4108b5, de0fac2e4500dabe0009e67214ff5f5447ce83dd, e1e007ce4eab7774785617179d1c01a9381ae83abfd431aae8dba6f82d3ac127, e291734d46c313a23d676681499f8846, e32eaf0c3cde9616831a1e92d42b0058, e7d582b98ca80690883175470e96f703ef6dc497, e80824a19f48d778a746571bb15279b5679fd61c, eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb, f2157f1cecbf3995aafad750e6e805c472cec466a53d17c2063f266ad2b3d625, f50a96d26a5b0beb29de4127e82b2bf350c21511e5a43d286e43f798dc6cd53f, f7a1e56b6dbd42778fe349b8412ab9749c78fa2bf41ea90b1165615ddfee52e4, fed52a4bbac7b5b6ae4f76cab3eadd67e79227e3, ff7ed7a0fa1c43eed01809d076feedbaed464fc7 Victim Industries: Aerospace, Artificial Intelligence, Automation, Cloud Infrastructure, Consulting Services, Cryptocurrency, E-commerce, Education, Enterprise, Financial Services, Financial Technology, Government, Healthcare, Hospitality, Human Resources, Industrial Sector, Information Security, Information Technology, Insurance, Internet & Cloud Services, Legal Services, Manufacturing, Media and Entertainment, Online Gambling, Pharmaceuticals, Professional Services, Public Sector, Real Estate, Retail, Robotic Process Automation, Security Services, Semiconductors, Social Media, Software, Technology Hardware, Transportation, Utilities & Energy Victim Countries: Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, India, Iran, Ireland, Israel, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Poland, Portugal, Romania, Russia, Singapore, Slovakia, Slovenia, South Korea, Spain, Sweden, Switzerland, Ukraine, United Kingdom, United States