New in Datadog Security Labs 🚨🚨: @\injectivelabs/sdk-ts v1.20.21 shipped with a backdoor disguised as "telemetry." It hooked key derivation and sent raw seed phrases + private keys. Full breakdown + IOCs: securitylabs.datadoghq.com/articles/not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor

Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor | Datadog Security Labs

A malicious commit disguised as SDK telemetry briefly compromised @injectivelabs/sdk-ts, exfiltrating wallet mnemonics and private keys.

securitylabs.datadoghq.com

It was an interesting 72 hours tracking down the second wave of Shai Hulud campaign. It's more sophisticated and aggressive than the first one. We published all what we know about it here securitylabs.datadoghq.com/articles/sha... #npm #shaihulud #malware

The Shai-Hulud 2.0 npm worm: analysis, and what you need to know | Datadog Security Labs

Learn more about the Shai-Hulud 2.0 npm worm.

securitylabs.datadoghq.com

Our team tracked down a malicious campaign in NPM deploying Vidar stealer. This is the first time we see Vidar stealer distributed via supply chain attack. securitylabs.datadoghq.com/articles/mut... #npm #malware #supplychainattack

MUT-4831: Trojanized npm packages deliver Vidar infostealer malware | Datadog Security Labs

Analysis of a threat actor campaign targeting Windows users with Vidar infostealer malware via malicious npm packages

securitylabs.datadoghq.com

I'm in love with claude code. The way it handles code writing and automates bash tasks is amazing and so convenient to me. if you are an experienced developer, know what you are doing, the tasks that usually take Weeks. You will be able to do it in Hours 🤯🤯 #claudecode #ai

Q for developers. Do you love/hate mandatory security training? And why? #security #training #developers

🚨 The obfuscation game: MUT-9332 targets Solidity developers via malicious VS Code extensions! Deep dive analysis in this obfuscated campaign including (PowerShell & VBS scripts, PE malware, Malicious browser extensions even stegomalware) Enjoy reading securitylabs.datadoghq.com/articles/mut...

The obfuscation game: MUT-9332 targets Solidity developers via malicious VS Code extensions | Datadog Security Labs

Analysis of a threat actor campaign targeting Solidity developers via three malicious VS Code extensions

securitylabs.datadoghq.com

Pretty interesting threat campaign have been discovered by our research team. We will be disclosing it in couple of hours , stay tuned 😉 #threats #malicious #security_research #datadog

Recognizing employees for a job well done is just as important as giving constructive feedback when they underperform. Balance builds growth. #Leadership #Feedback

I don't like threat actors attribution that much because in most cases it's wrong and so easily to be forged. We still should cluster campaigns but there is no "high confidence" attribution IMHO.

Nice work for using AI to create POC by analysis the patch diff platformsecurity.com/blog/CVE-202...

How I Used AI to Create a Working Exploit for CVE-2025-32433 Before Public PoCs Existed

A step-by-step walkthrough of how I leveraged AI to analyze, understand, and exploit the Erlang SSH pre-authentication vulnerability (CVE-2025-32433) without any existing public proof of concept. Lear...

platformsecurity.com

I have been told there will be a special announcement at 10am CET (that's 4am EDT btw) regarding this. I will release the info I have at that time also. Thank you for the support.

Tib3rius@tib3rius.bsky.social · last yr.

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

Any idea what will happen to the CVE program after MITRE x.com/0xTib3rius/s...

It’s the tutorial room at #kubecon where we’ll be hacking up a storm in just over 30 minutes!

Interesting to see secret leaks in git still one the biggest threats in SDLC. github.blog/security/app...

I think it's time for me to start digging into AI and LLMs. I'm not sure where to start, any advice?

It's amazing how important one Phrack article from 27 years ago has been for web application security. Covering what we now call SQL Injection and SSRF (amongst other things) problems we're still trying to handle today laid out in a couple of paragraphs phrack.org/issues/54/8#...

This time we analyzed the Next.js middleware bypass vulnerability (CVE-2025-29927). Also included IP/UA trying to exploit this in the wild. securitylabs.datadoghq.com/articles/nex...

Understanding CVE-2025-29927: The Next.js Middleware Authorization Bypass Vulnerability | Datadog Security Labs

Learn how the Next.js middleware authorization bypass vulnerability works, and how to detect and remediate it.

securitylabs.datadoghq.com

Our analysis and takeaways for IngressNightmare - Several vulnerabilities in the Kubernetes Ingress NGINX Controller. Enjoy! securitylabs.datadoghq.com/articles/ing...

The

Learn how the Kubernetes Ingress NGINX Controller vulnerabilities work, how to detect and remediate them.

securitylabs.datadoghq.com

I love it when some people tells me that's is your limit, this is your ceiling. This is when I feel fire within me reignite!

Amazing presentation about supply chain security and the amazing work we do by our leaders @techy.detectionengineering.net (Director of research) and Andrewkrug (Manager of advocacy) youtu.be/1b0RIi19qrw?...

AWS re:Invent 2024 - Beyond just observing, protecting your whole software supply chain (SEC406)

YouTube video by AWS Events

youtu.be

Supply chain firewall in action github.com/DataDog/supp...

Datadog Security Labs@securitylabs.datadoghq.com · 2y ago

We are happy to introduce our latest tool "Supply Chain Firewall" 🎉 by @ikretz.bsky.social The tool detects & prevents installation of malicious packages in local development environment. Read more securitylabs.datadoghq.com/articles/int... And give it a try github.com/DataDog/supp...

Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages | Datadog Security Labs

Release of Supply-Chain Firewall, an open source tool for preventing the installation of malicious PyPI and npm packages

securitylabs.datadoghq.com

Supply-chain attack in the ultralytics PyPI package: github.com/ultralytics/... An attacker opened a pull request and pushed a commit with a malicious name, leading to CI code injection. They then backdoored versions 8.3.41 and 8.3.42 with code downloading a second-stage binary from GitHub

Common reasoning is that SMS 2FA is bad due to the risk of SIM swapping. It’s also bad if the telecommunications networks are hostile 😬 www.forbes.com/sites/zakdof...

FBI Warns iPhone And Android Users—Stop Sending Texts

US officials urge citizens to use encrypted messaging and calls wherever they can—here’s what you need to know.

forbes.com

Awesome, Stratus Red Team v2.20.0 is now available 🎉

Christophe Tafani-Dereeper@christophetd.fr · 2y ago

Stratus Red Team v2.20.0 is now available, with great contributions from @flekyy90.bsky.social allowing you to reproduce AWS TTPs seen in the wild! ➔ Use GetFederationToken to generate temporary credentials ➔ Use SendSerialConsoleSSHPublicKey to pivot to EC2 instances github.com/DataDog/stra...

My Blackhat MEA arsenal presentation: "Detect Malicious Packages with Guarddog" drive.google.com/file/d/11SAN...

Looks good, I will give it a try this weekend

Rory McCune@mccune.org.uk · 2y ago

For a lot of my research work, kind clusters work perfectly but sometimes having a full disposable VM with tools is needed. Just been playing with github.com/iximiuz/labctl from @iximiuz.bsky.social and it looks like a great option for those times (also you can get full k8s clusters and things too)

We released Censeye today, an open source CLI tool that makes it dramatically easier to pivot and find related assets when threat hunting on Censys instead of manually checking for potential identifying characteristics like an SSH host key. github.com/Censys-Resea...

They try to explain the crazy world of today's security acronyms, good luck with that 😀 #BHMEA24

They are taking it seriously this year with hacking infrastructure #BHMEA24