TrapDoor Malware Hits Open-Source Registries (5.25)

TrapDoor, a credential-stealing campaign reported on May 25, targeted npm, PyPI and Crates.io with more than 34 malicious packages across over 384 versions.…

TrapDoor Malware Hits Open-Source Registries (5.25)

Overview

TrapDoor was reported as a coordinated supply-chain campaign using more than 34 malicious packages across npm, PyPI and Crates.io to spread credential-stealing malware.
Lazarus-linked RemotePE activity showed continued pressure on financial and cryptocurrency organizations through a multi-stage malware chain.
Ghost CMS exploitation centered on CVE-2026-26980, a critical SQL injection flaw tied to JavaScript injection and ClickFix attacks on more than 700 sites.
CISA, NIST, Microsoft and Google remained the official reference layer for advisories, CVE metadata, vendor response details and security research during the May 25 coverage window.

TrapDoor Campaign Targets Three Developer Ecosystems

The Hacker News feed reported that TrapDoor, a coordinated software supply-chain campaign, targeted npm, PyPI and Crates.io with credential-stealing malware. The campaign was described as spanning more than 34 malicious packages across more than 384 versions, giving defenders a broad package-management footprint rather than a single compromised artifact to isolate.

The timing also matters. The earliest recorded activity in the supplied reporting began on May 22, 2026, at 8:20 p.m. UTC, with later packages published in waves. That pattern points to an operation designed to test and reuse multiple language ecosystems instead of relying on one repository or one developer community.

The campaign's practical risk is direct: developers often install packages inside environments that hold tokens, cloud credentials, repository access and build-system secrets. A credential-stealing payload inside a package manager can therefore turn a local dependency decision into an organizational compromise.

▸ TrapDoor deep dive

TrapDoor fits a broader supply-chain pattern in which attackers move toward developer tooling because software packages sit close to production access. The reported spread across npm, PyPI and Crates.io is important because those ecosystems map to JavaScript, Python and Rust development workflows. A campaign that reaches all three can encounter front-end projects, automation scripts, back-end services, command-line tools and infrastructure code.

The number of versions is as significant as the number of packages. More than 34 malicious packages is already a sizable set for defenders to review, but more than 384 versions means the campaign created many separate versioned artifacts that could appear in lockfiles, mirrors, caches and build histories. Even after a malicious package is removed, older versions may persist inside internal package proxies or reproducible build records.

The wave-based publication pattern suggests operational staging. Publishing in waves can help attackers observe which packages survive moderation, which names attract downloads and which ecosystems respond fastest. It can also complicate detection because defenders may find one package family while another branch of the campaign is still being seeded elsewhere.

For security teams, the immediate implication is that package identity alone is not enough. Version history, install timing and dependency paths become part of the investigation. A project that did not directly install a malicious package could still be exposed through a transitive dependency or a temporary build environment that fetched one of the affected versions during the campaign window.

The reporting does not provide download counts, confirmed victim numbers or a full package list in the supplied evidence. That limits the confidence of any impact estimate. Still, the available figures are enough to show why this campaign belongs near the top of the May 25 security agenda: it combined credential theft, multiple open-source registries and a version count large enough to create cleanup work beyond simple package removal.

Lazarus-Linked RemotePE Pressures Finance and Crypto Firms

The Hacker News feed reported that researchers described RemotePE as a cross-platform malware tool used by the North Korea-linked Lazarus Group against financial and cryptocurrency organizations. The report attributed the technical analysis to Fox-IT, a subsidiary of NCC Group.

RemotePE was described as part of a multi-stage chain involving two loaders, DPAPILoader and RemotePELoader. That structure is notable because staged loaders can separate initial access, decryption, payload delivery and execution, making the final malware harder to detect at the first point of compromise.

The targeting profile is consistent with Lazarus reporting over many years: financial institutions and cryptocurrency firms offer direct monetary value, while their operational environments often include high-value credentials and transaction infrastructure.

▸ RemotePE deep dive

The RemotePE report is less about a single file and more about attack architecture. A multi-stage chain gives operators flexibility. If one component is detected, another can be swapped. If a loader reaches a target but cannot complete execution, the operators may still learn about the environment. That modularity is one reason loader-based malware remains durable in campaigns aimed at high-value organizations.

The supplied evidence identifies DPAPILoader and RemotePELoader as the two loader names in the chain. Even without the full technical breakdown, the naming indicates a sequence in which one component prepares or decrypts material and another handles the RemotePE payload. For defenders, that means detection should not focus only on the final remote-access tool. Earlier-stage loader behavior may provide a better chance to interrupt the operation before the payload is active.

The cross-platform description also raises the cost of defense. Financial and cryptocurrency firms often run mixed environments: employee endpoints, cloud workloads, developer machines, trading systems, administrative consoles and infrastructure services. Malware that can operate across platforms can follow the target's operational reality rather than being confined to one operating-system boundary.

The financial and cryptocurrency focus also changes the risk calculation. In some sectors, espionage or persistence may be the primary concern. In this case, the likely exposure includes wallet infrastructure, exchange systems, treasury operations, customer funds, internal credentials and transaction approval workflows. That makes identity controls, endpoint telemetry and privileged-access monitoring central to the response.

The evidence does not state how many organizations were targeted, whether funds were stolen or which platforms were most affected. Those are material gaps. The confirmed point is narrower but still consequential: researchers linked a cross-platform RemotePE malware chain to Lazarus activity against finance and crypto targets, and the named loader structure gives defenders concrete behavior to hunt.

Ghost CMS Flaw Used in ClickFix Site Hijacking

The Hacker News feed reported that threat actors were exploiting CVE-2026-26980 in Ghost CMS to inject malicious JavaScript for ClickFix attacks. The report cited QiAnXin XLab and described the flaw as a critical SQL injection issue in Ghost's Content API with a CVSS score of 9.4.

The supplied headline says more than 700 sites were hijacked, making this more than a theoretical vulnerability disclosure. The exploitation path matters because malicious JavaScript on a publishing platform can reach ordinary site visitors, not just administrators or server operators.

The reported attack goal, ClickFix, places the vulnerability in a social-engineering context. Instead of only stealing data from the CMS, attackers can use compromised pages to push visitors toward harmful actions under the appearance of a browser, access or verification problem.

▸ Ghost CMS deep dive

The Ghost CMS case shows how a back-end application flaw can become a front-end user risk. SQL injection is traditionally discussed in terms of database access, but the reported activity used the flaw to inject JavaScript. That bridge from server-side weakness to client-side manipulation is what makes the campaign operationally significant.

A CVSS score of 9.4 places CVE-2026-26980 in the critical range. The supplied evidence says the issue affects Ghost's Content API and could allow an unauthenticated attacker to read arbitrary data. Unauthenticated exposure is especially serious because attackers do not need stolen administrator credentials to begin probing vulnerable systems.

The more-than-700-site figure changes the response priority. A single compromised site can be handled as incident response. Hundreds of affected sites point to automation, repeatable exploitation or a broad vulnerable population. That scale also means users may encounter malicious prompts through sites they already trust, which can make ClickFix-style lures more effective.

For publishers and site operators, the operational concern is twofold. First, they must address the application vulnerability itself. Second, they must inspect public pages, templates, injected scripts and cached content for signs that the site continued serving malicious JavaScript after the original compromise. Removing the vulnerability without checking the delivered content may leave the visible attack in place.

The supplied reporting does not include patch-version details, exploit code, affected Ghost versions or remediation steps. It does, however, provide enough to define the risk: a critical Content API SQL injection flaw was being exploited in the wild, the activity was tied to JavaScript injection, and the reported victim count exceeded 700 sites.

Official Advisory Sources Anchor the Response Baseline

CISA, NIST, Microsoft and Google appeared in the May 25 source set as official security references rather than as separate incident reports. CISA was listed for cybersecurity advisories and mitigation guidance, NIST for CVE records and severity metadata, Microsoft for its security update guide, and Google for security research and vulnerability disclosure posts.

These sources serve a different role from the threat reports. The Hacker News feed supplied the incident-level developments, while the official channels provide the places where vulnerability identifiers, vendor responses, severity records and mitigation guidance are normally stabilized.

The dataset also labels these official entries as fallback references for May 25 when dated collectors were below the independent-source threshold. That caveat should be read as a sourcing note, not as evidence that each agency or vendor issued a new same-day advisory on every incident discussed above.

▸ official advisories deep dive

The distinction between threat reporting and official advisory infrastructure is important. Incident reports often move first, especially when researchers publish campaign details or when exploitation is visible in the wild. Official sources usually serve a slower but more authoritative function: confirming identifiers, recording severity metadata, publishing vendor guidance and consolidating mitigation language.

CISA's advisory role matters because many organizations use it as an operational signal for patching, emergency directives and defensive prioritization. In a week with supply-chain malware, a critical CMS flaw and state-linked malware reporting, CISA-style guidance helps translate scattered security news into action categories such as mitigation, monitoring or escalation.

NIST's National Vulnerability Database plays a different role. It is not primarily a news outlet; it is a structured reference for CVE records and severity metadata. That makes it useful when a story includes a vulnerability identifier such as CVE-2026-26980. Severity scoring alone does not prove exploitation, but it helps organizations compare one vulnerability against another inside patch-management queues.

Microsoft's Security Response Center is vendor-specific, which narrows its scope but increases its value when Microsoft products or dependencies are involved. Its update guide is built for vulnerability response, including the kind of information defenders need when deciding whether a patch applies to their environment.

Google's security blog occupies another part of the ecosystem: research, product security and vulnerability disclosure. In this source set, it functions as part of the official reference layer rather than as a direct source for the TrapDoor, RemotePE or Ghost CMS facts. The value is contextual. Official research channels help establish how major vendors communicate security findings, even when a given day's incident reporting comes from specialist outlets.

The practical takeaway is that May 25's threat stories should not be treated as isolated headlines. A credible response workflow would separate fast-moving campaign intelligence from official records and vendor guidance, then reconcile them as more precise advisories become available.

▸ More — additional context and sources

TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO

Reported by feeds.feedburner.com. A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stea…

Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms

Reported by feeds.feedburner.com. Cybersecurity researchers have shed light on a cross-platform malware called RemotePE that has been put to use by the North Korea-linked La…

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

Reported by feeds.feedburner.com. Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fu…

The Alert Firehose Finally Meets Its Match

Reported by feeds.feedburner.com. Ask a cybersecurity pro about Network Detection and Response (NDR) and you might still hear "Noisy," "Too much data." But ask the teams run…

At a glance

Fact	Publisher	Source
TrapDoor targeted npm, PyPI and Crates.io with credential-stealing malware.	feeds.feedburner.com	thehackernews.com
Ghost CMS CVE-2026-26980 was tied to attacks on more than 700 sites.	feeds.feedburner.com	thehackernews.com
CISA maintains official cybersecurity advisories and mitigation guidance.	CISA	cisa.gov
NIST provides CVE records and severity metadata through the NVD.	NIST	nvd.nist.gov
Microsoft publishes vulnerability response details through its update guide.	Microsoft	msrc.microsoft.com
Google publishes security research and vulnerability disclosure updates.	Google	security.googleblog.com

FAQ

Q1. Why does the TrapDoor package count matter?

A. The Hacker News feed reported more than 34 malicious packages across over 384 versions, which means defenders must review version histories and build artifacts, not only package names.

Q2. What makes RemotePE more concerning than a single malware sample?

A. Fox-IT's analysis, cited in the supplied reporting, placed RemotePE inside a chain with DPAPILoader and RemotePELoader, so the risk includes staged execution as well as the final payload.

Q3. How does the Ghost CMS flaw affect ordinary website visitors?

A. The Hacker News feed reported that CVE-2026-26980 was used to inject malicious JavaScript for ClickFix attacks, shifting the impact from CMS compromise to visitor-facing manipulation.

Q4. Why include CISA, NIST, Microsoft and Google if the threat reports came from one feed?

A. CISA, NIST, Microsoft and Google provide the official advisory, CVE, vendor-response and security-research channels that organizations use to validate and operationalize incident reporting.

Q5. What remains uncertain in the May 25 reporting?

A. The supplied evidence gives strong figures for TrapDoor versions and Ghost site impact, but it does not provide confirmed victim counts for RemotePE or complete remediation details for CVE-2026-26980.

Sources

Last updated: 2026-05-25T15:29:24.547Z

Mini-Step

이 블로그 검색