Weekly Cyber Threats: SideWinder Phishing, npm Supply Chain & More

This week's threat landscape underscores how ordinary development and communication tools continue to be weaponized at scale. From nation-state-aligned telecom exposure to automated package poisoning, attackers are leaning on cheap leverage—exposed servers, recycled vulnerabilities, and trusted defaults that defenders underestimate.

A bipartisan U.S. Congressional report titled "Stranger Pings" has raised fresh alarms about Chinese state-linked telecom operators maintaining trusted positions inside U.S. communications infrastructure. The 49-page document links this residual presence to enabling the Salt Typhoon campaign, warning that PRC providers are bound by contract clauses prohibiting broadcasts deemed politically sensitive under Chinese law—a constraint that effectively turns trusted network nodes into potential surveillance chokepoints. Operators concerned about routed traffic from high-risk ASNs can audit their exposure using a WHOIS lookup to verify registrant details and upstream providers.

The APT group SideWinder has shifted tactics with a new multi-stage attack chain that abuses ClickOnce application files delivered through weaponized PDF attachments. Once executed, the chain deploys Rust-based backdoors that establish persistence through registry modifications, harvest host intelligence, and beacon to command infrastructure hosted on free serverless platforms like Cloudflare Workers. The abuse of legitimate Microsoft deployment frameworks makes detection difficult, since ClickOnce launches originate from trusted signed binaries. Defenders can validate whether their endpoints are leaking telemetry via a browser fingerprint test to surface anomalies in outbound traffic.

Meanwhile, Sonatype has disclosed a sprawling npm supply chain campaign dubbed "Flooding Dropper," involving 846 malicious packages uploaded using automated account creation. The packages blend terms like "bigops" and "bnpl" with version patterns in the 35.x.y range, then fetch second-stage payloads through redundant delivery methods. Despite syntactic variation between samples, all variants execute the same final-stage loader—a hallmark of automated generation pipelines that defenders can no longer track manually. Developers should verify package integrity and rotate any credentials potentially exposed during the incident using a password checker to confirm no leaks have occurred.