INTERPOL Arrests 6K in Fraud Sweep, npm Supply Chain Hits Payment SDKs

A coordinated global anti-fraud operation, codenamed First Light 2026, led to the arrest of 5,811 individuals across 97 countries and territories, with authorities intercepting $293 million in illicit assets. INTERPOL announced that the takedown, which ran from January 15 to April 30, 2026, targeted social engineering scams and associated money laundering networks. Investigators identified more than 142,000 victims worldwide and opened over 23,000 cases. Notable disruptions included Eswatini authorities arresting 82 people linked to illegal online gambling and impersonation scams, while Thai police uncovered a money laundering pipeline that converted romance scam proceeds into cryptocurrency via cross-chain token swaps designed to obscure financial trails.

Security researchers at Socket have uncovered a cluster of 17 malicious packages on the npm and PyPI registries that typosquat the SDKs of legitimate payment platforms Paysafe, Skrill, and Neteller. Once installed, the packages harvest system information and developer secrets before exfiltrating the data to an attacker-controlled Ngrok endpoint. The malware deliberately skips machines exhibiting fewer than two CPU cores or hostnames/usernames containing sandbox, analyzer, cuckoo, virus, malware, vmware, or vbox—clear sandbox-evasion tactics. The threat actor used unique obfuscation keys per package version to prevent signature-based detection, resulting in distinct file hashes that complicate tracking. Developers should audit their environments and verify suspicious endpoints with a DNS leak test while reviewing the provenance of unfamiliar packages using a WHOIS lookup on associated domains.

A new code injection technique dubbed Process Parameter Poisoning (P³) has been detailed by researchers, including Max Hirs..., as a stealthy way to stage shellcode inside foreign processes without triggering standard security alarms. The P³-Shellcode Loader abuses the Process Parameters structure—a normally benign block of metadata used during process creation—as both an execution location and a staging area for shellcode injection into remote processes. Because the technique leverages legitimate Windows internals rather than classic VirtualAlloc/WriteProcessMemory patterns, it can bypass common detection mechanisms. Defenders are advised to monitor anomalies in process parameter fields, inspect unusual parent-child process relationships, and periodically run a port scanner to validate exposed services across the perimeter.