CuraSec

tag: Worm · 2 items

Plan archived WeChat Zero-Click Worm Spreads via Incoming Calls on iOS and Android
2026-09-08 · The Hacker News · source ↗ #zero-click#mobile-security#worm
  • Engineer — Plan: If WeChat is in your enterprise environment (especially for Asia-region business communications), verify the app is updated to a post-July 2026 patched version; the zero-click, no-answer-required attack surface makes unpatched installs high-severity even without active exploitation signals.
  • SOC/IR — Learn: No IOCs, no mapped TTPs, and no evidence of active exploitation are provided; the worm propagation technique is notable for future detection design, but there is no actionable hunt or rule to write today.
  • Leader — Learn: A research-stage demo with no confirmed active exploitation and an apparent Tencent patch in progress; revisit if Tencent confirms a breach or if exploitation surfaces, particularly if your org relies on WeChat for business communication with China-based partners.
Act archived ChainDrop worm spread via 400+ malicious npm packages
2026-08-05 · Microsoft Security Blog · source ↗ #supply-chain#npm#worm
  • Engineer — Act: A self-propagating worm across 400+ npm packages directly threatens any JavaScript/Node.js dependency tree; audit all npm dependencies against the compromised package list in the Microsoft post, inspect CI/CD build logs for IOCs, and rotate any credentials present in affected build environments.
  • SOC/IR — Act: Microsoft’s write-up includes attack chain details and explicit detection and hunting guidance; run hunts for the described IOCs in pipeline and build-system logs and tune detections for the self-republishing propagation behavior since 2026-08-04.
  • Leader — Act: 400+ compromised npm packages is a systemic supply chain event comparable in breadth to prior ecosystem-wide incidents; this week confirm whether internal or third-party software uses affected packages and prepare a brief for leadership in case customers or the board surface questions.