--- title: Rising Credential Theft & Supply Chain Risks description: Australian organisations face heightened cyber threats, requiring enhanced endpoint visibility, robust identity security, and rapid patching to combat evolving attack methods and software vulnerabilities. image: https://digitalfrontierpartners.com.au/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20modern%20office%20environment%20bustling%20with%20activity%20In%20the%20foreground%20a%20diverse%20group%20of%20professionals%20huddles%20around%20a%20sleek%20confere-1.png --- [Skip to content](https://digitalfrontierpartners.com.au/news/rising-credential-theft-supply-chain-risks#main-content) [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp)](https://www.digitalfrontierpartners.com.au/) - [Services](https://digitalfrontierpartners.com.au/news/rising-credential-theft-supply-chain-risks#products) Show submenu for Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) - Resources Show submenu for Resources - [News](https://digitalfrontierpartners.com.au/news/tag/news) - [Case Studies](https://digitalfrontierpartners.com.au/news/tag/case-study) - [Research](https://digitalfrontierpartners.com.au/news/tag/research) - [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) - [About](https://digitalfrontierpartners.com.au/news/rising-credential-theft-supply-chain-risks#about) Show submenu for About - [About Us](https://digitalfrontierpartners.com.au/about) - [Contact Us](https://digitalfrontierpartners.com.au/contact) Open main navigation Close main navigation - [Services](https://digitalfrontierpartners.com.au/news/rising-credential-theft-supply-chain-risks#products) Show submenu for Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) - Resources Show submenu for Resources - [News](https://digitalfrontierpartners.com.au/news/tag/news) - [Case Studies](https://digitalfrontierpartners.com.au/news/tag/case-study) - [Research](https://digitalfrontierpartners.com.au/news/tag/research) - [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) - [About](https://digitalfrontierpartners.com.au/news/rising-credential-theft-supply-chain-risks#about) Show submenu for About - [About Us](https://digitalfrontierpartners.com.au/about) - [Contact Us](https://digitalfrontierpartners.com.au/contact) - [Contact us](https://digitalfrontierpartners.com.au/contact) [Contact us](https://digitalfrontierpartners.com.au/contact) 20 January 2026, 11:52:25 am AEDT # Rising Credential Theft & Supply Chain Risks ![Picture of Digital Frontier Partners](https://digitalfrontierpartners.com.au/hs-fs/hubfs/500x%20DFP%20(3).png?width=50&name=500x%20DFP%20(3).png) [Digital Frontier Partners](https://digitalfrontierpartners.com.au/news/author/digital-frontier-partners) This week’s developments highlight an increasingly challenging security environment for Australian organisations. Threat actors are shifting toward scalable, low‑friction attack methods—such as credential hijacking via malicious browser extensions, QR‑code–based phishing, and automated botnet activity—while simultaneously exploiting high‑severity software flaws across email gateways, workflow automation tools, Git services, and industrial control systems. For business leaders, the message is clear: traditional security perimeters are no longer enough. Protecting the organisation now requires deeper visibility across endpoints, cloud services, and third‑party components, supported by disciplined patching and robust identity security. --- ## **The Threats at the Gates** Organisations worldwide—and increasingly across Australia—faced a surge in credential theft, malware delivery, and supply chain compromise. North Korea’s **Kimsuky** group escalated *QR‑code phishing (“quishing”)* campaigns, using malicious QR codes embedded in emails to harvest cloud identity tokens and bypass URL filtering. Russian group **APT28** continued targeting credentials via spoofed Outlook and Google login portals, while China‑linked **UAT‑7290** breached telecom providers by exploiting edge‑device vulnerabilities and deploying Linux implants such as *RushDrop* and *SilentRaid*. Sectors like hospitality experienced tailored attacks through the **ClickFix** campaign, which leveraged fake Booking.com cancellation emails and even a fabricated Blue Screen of Death to deploy *DCRat*. In Brazil, the **Astaroth** banking worm spread rapidly through compromised WhatsApp contact lists. Supply chain compromise remained a major theme. Attackers injected **NodeCordRAT** into npm libraries, hijacked legitimate Chrome extension namespaces to harvest **ChatGPT conversations from more than 900,000 users**, and leveraged the **React2Shell (CVE‑2025‑55182)** flaw within Next.js to facilitate botnet‑driven cryptomining and Mirai deployment. Critical vulnerabilities in email gateways, workflow automation platforms, industrial controllers, and Git hosting systems underscore the urgent need for vulnerability management and asset hardening across IT and OT environments. --- ## **Software Vulnerabilities and Patch Advisories** This week’s patching actions spanned cloud platforms, enterprise tools, open‑source projects, and industrial control systems: - **Microsoft Patch Tuesday** resolved 112 CVEs, including an actively exploited Desktop Window Manager zero‑day (CVE‑2026‑20805) and two critical NTFS RCE flaws. - **Cisco AsyncOS Zero‑Day RCE (CVE‑2025‑20393)**—used since late 2025—received urgent fixes. - **Palo Alto GlobalProtect** addressed a new high‑severity DoS vulnerability (CVE‑2026‑0227). - **FortiSIEM (CVE‑2025‑64155)**: A command‑injection flaw is now actively exploited, prompting interim guidance to restrict exposed ports. - **n8n Workflow Automation**: A CVSS 10.0 RCE vulnerability allows full takeover of unpatched instances. - **Node.js (CVE‑2025‑59466)** resolved an async\_hooks denial‑of‑service flaw. - **Gogs Git Hosting (CVE‑2025‑8110)** is under real‑world exploitation via path traversal in the repository editor. - ICS vendors including **AVEVA**, **Delta Electronics**, **Schneider Electric**, **Rockwell**, and **Siemens** released multiple critical advisories affecting energy, water, and manufacturing systems. Australian organisations—especially those operating critical infrastructure—should prioritise rapid patch adoption, enforce network segmentation, and verify least‑privilege access for all administrative accounts. --- ## **Emerging Malware Frameworks and Campaigns** New malware families and updated frameworks demonstrated increasing sophistication: - **VoidLink**: A modular Linux toolkit with kernel‑level evasion targeting container and cloud environments. - **PLUGGYAPE**: A Python backdoor deployed via fake charity lures on Signal and WhatsApp. - **SHADOW#REACTOR**: A fileless payload chain using entirely text‑based delivery via VBScript and PowerShell to load *Remcos RAT*. - **Agent Tesla, CryptBot, Lumma Stealer**: Delivered through c‑ares DLL side‑loading. - **GoBruteforcer**: Targeted >50,000 Linux servers using AI‑generated default credentials. - **Mustang Panda’s LOTUSLITE**: A spear‑phishing backdoor using DLL side‑loading. Botnets continued to expand capacity and monetisation models: - **Kimwolf** and **AISURU** now control over **two million Android devices**, repurposing them as residential proxies. - **GhostPoster** and HR‑targeting malicious Chrome extensions collectively reached **over 840,000 installs**, exfiltrating authentication tokens and blocking access to security settings. --- ## **State‑Sponsored and Organised Cyber Threats** Multiple APT groups increased operational tempo: - **Mustang Panda** targeted U.S. policy organisations using politically themed phishing with LOTUSLITE malware. - **UAT‑8837** and **UAT‑9686** exploited zero‑days in Sitecore and Cisco AsyncOS to infiltrate North American enterprise networks. - **Void Blizzard** (Russia) deployed PLUGGYAPE against Ukrainian defence entities. - Taiwan observed a **6% increase** in daily attacks on healthcare and energy operators by Chinese groups including Flax Typhoon. - Intelligence agencies warn of heightened nation‑state activity targeting **Winter Olympics** infrastructure and attendees. Australian critical‑infrastructure operators should watch for indicators linked to these groups and reinforce patching, monitoring, and phishing defences across operational environments. --- ## **Phishing, Social Engineering and Fraud Operations** Criminal groups expanded their use of deceptive techniques: - **Kimsuky quishing** bypasses traditional email scanning by shifting malicious links into QR codes. - **MEXC API Automator** and other malicious browser extensions automatically generated withdrawal‑enabled API keys for cryptocurrency platforms. - **Pig‑butchering fraud kits** sold via Southeast Asian criminal networks offer turnkey playbooks, pre‑registered identities, payment processors, and CRM systems. - **Tycoon2FA** phishing‑as‑a‑service campaigns surge, spoofing Office 365 domains and bypassing MFA using reverse proxies. Mitigation strategies include enforcing FIDO2‑grade MFA, blocking unvetted browser extensions, logging suspicious API‑key creation, and using QR‑code validation tooling. --- ## **Supply Chain and Third‑Party Component Risks** This week’s major supply chain developments include: - **n8n npm supply chain attack**: Eight malicious community nodes—including a fake Google Ads integration—stole OAuth tokens from over 4,000 downloads. - **AWS CodeBuild misconfiguration (“CodeBreach”)**: Raised concerns around unauthenticated code injection into AWS‑managed GitHub repositories. - **zlib (CVE‑2026‑22184)**: A critical buffer‑overflow affects countless applications dependent on the widely used compression library. Australian organisations should verify the origin of third‑party software, audit CI/CD configurations regularly, and prioritise updates to foundational libraries. --- ## **Recommended Business Actions** 1. **Prioritise patching for actively exploited vulnerabilities**, especially Cisco AsyncOS, FortiSIEM, MongoDB, n8n, and industrial control products. 2. **Harden identity verification** by deploying phishing‑resistant MFA and closely monitoring login anomalies, QR‑code use, and OAuth approvals. 3. **Lock down browser extension usage** with enterprise‑wide allowlists and session token monitoring. 4. **Segment and monitor OT environments** to prevent lateral movement into critical operational systems. 5. **Strengthen supply chain visibility**, including SBOM management, CI/CD auditing, and continual dependency verification. 6. **Prepare for human‑layer attacks** through staff training and simulated phishing exercises that now incorporate QR‑code lures and cloud‑identity theft scenarios. [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) ## Related posts [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/AI-Generated%20Media/Images/A%20sleek%2c%20modern%20office%20conference%20room%20is%20abuzz%20with%20activity.jpeg?height=200&name=A%20sleek%2c%20modern%20office%20conference%20room%20is%20abuzz%20with%20activity.jpeg)](https://digitalfrontierpartners.com.au/news/strategic-cybersecurity-turning-risks-into-competitive-advantages) ## [Strategic Cybersecurity: Turning Risks into Competitive Advantages](https://digitalfrontierpartners.com.au/news/strategic-cybersecurity-turning-risks-into-competitive-advantages) 14 February 2025, 7:49:28 am AEDT [Read more](https://digitalfrontierpartners.com.au/news/strategic-cybersecurity-turning-risks-into-competitive-advantages) [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/AI-Generated%20Media/Images/Cybersecurity%20Analysts%20in%20HighTech%20Office%20Environment-1.png?height=200&name=Cybersecurity%20Analysts%20in%20HighTech%20Office%20Environment-1.png)](https://digitalfrontierpartners.com.au/news/ai-accelerated-exploits-dependency-compromise-and-rising-ot-risk) ## [AI‑Accelerated Exploits, Dependency Compromise and Rising OT Risk](https://digitalfrontierpartners.com.au/news/ai-accelerated-exploits-dependency-compromise-and-rising-ot-risk) 21 April 2026, 2:25:21 pm AEST [Read more](https://digitalfrontierpartners.com.au/news/ai-accelerated-exploits-dependency-compromise-and-rising-ot-risk) [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20dark%20ominous%20digital%20landscape%20filled%20with%20abstract%20representations%20of%20cyber%20threats%20In%20the%20foreground%20a%20glowing%20orange%20ransomware%20symbol%20looms%20large%20surrounded%20by%20fragmented%20data%20streams%20and%20glitching%20code%20symbolizing%20the%20chaos%20o.png?height=200&name=The%20image%20depicts%20a%20dark%20ominous%20digital%20landscape%20filled%20with%20abstract%20representations%20of%20cyber%20threats%20In%20the%20foreground%20a%20glowing%20orange%20ransomware%20symbol%20looms%20large%20surrounded%20by%20fragmented%20data%20streams%20and%20glitching%20code%20symbolizing%20the%20chaos%20o.png)](https://digitalfrontierpartners.com.au/news/australia-faces-rising-cyber-threats-urgent-action-required) ## [Australia Faces Rising Cyber Threats: Urgent Action Required](https://digitalfrontierpartners.com.au/news/australia-faces-rising-cyber-threats-urgent-action-required) 18 August 2025, 1:14:31 pm AEST [Read more](https://digitalfrontierpartners.com.au/news/australia-faces-rising-cyber-threats-urgent-action-required) ###### Visit Us On: [linkedin-in icon](https://www.linkedin.com/company/digitalfrontierpartners/posts/?feedView=all) [Follow us on Facebook](https://www.youtube.com/watch?v=-BsUxioXzCk&t=6s) --- [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp)](https://digitalfrontierpartners.com.au/) Level 4, 350 Collins St, Melbourne VIC, Australia 3000 +61 [1800 288 817](https://www.google.com/search?q=digital+frontier+partners&oq=digital+&gs_lcrp=EgZjaHJvbWUqDwgAECMYJxjjAhiABBiKBTIPCAAQIxgnGOMCGIAEGIoFMhUIARAuGCcYrwEYxwEYgAQYigUYjgUyBggCEEUYOTIMCAMQABhDGIAEGIoFMgwIBBAAGEMYgAQYigUyBggFEEUYPDIGCAYQRRg8MgYIBxBFGDzSAQg0MzQ1ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8#) Company   - [Home](https://digitalfrontierpartners.com.au/hp) - [About Us](https://digitalfrontierpartners.com.au/about) - [Careers](https://digitalfrontierpartners.zohorecruit.com.au/jobs/Careers) - [Contact Us](https://digitalfrontierpartners.com.au/contact) --- Resources - [News](https://digitalfrontierpartners.com.au/news) - [Research](https://digitalfrontierpartners.com.au/news) - [Weekly Cyber Report](https://digitalfrontierpartners.com.au/news) - [Case Studies](https://digitalfrontierpartners.com.au/news) --- Policies - [Privacy Policy](https://digitalfrontierpartners.com.au/news/privacy-policy) - [Information Security Policy](https://digitalfrontierpartners.com.au/news/information-security-policy) - [Quality Policy](https://digitalfrontierpartners.com.au/news/quality-policy) Products and Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise Artificial Intelligence (AI)](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) --- Industries - [Local Government](https://digitalfrontierpartners.com.au/localgovernment-cybersecurity) - [Financial Services Cyber Security](https://digitalfrontierpartners.com.au/financialservices) - [Financial Services Artificial Intelligence](https://digitalfrontierpartners.com.au/financial-services-artificial-intelligence) - [Mid Market Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-artificial-intelligence) - [Aged Care Roster Optimisation](https://digitalfrontierpartners.com.au/aged-care-rostering-optimisation) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Digital Frontier Partners", "url" : "https://digitalfrontierpartners.com.au/news/author/digital-frontier-partners" }, "dateModified" : "2026-01-20T00:52:25.615Z", "datePublished" : "2026-01-20T00:52:25.000Z", "headline" : "Rising Credential Theft & Supply Chain Risks", "image" : [ "https://digitalfrontierpartners.com.au/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20modern%20office%20environment%20bustling%20with%20activity%20In%20the%20foreground%20a%20diverse%20group%20of%20professionals%20huddles%20around%20a%20sleek%20confere-1.png" ], "mainEntityOfPage" : { "@id" : "https://digitalfrontierpartners.com.au/news/rising-credential-theft-supply-chain-risks", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://digitalfrontierpartners.com.au/hubfs/DFP-Logo.webp" } } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://digitalfrontierpartners.com.au/#organisation", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "AU", "addressLocality" : "Melbourne", "addressRegion" : "VIC", "postalCode" : "3000", "streetAddress" : "Level 4, 350 Collins Street" }, "description" : "Digital Frontier Partners provides enterprise technology advisory, AI enablement, workforce optimisation and cybersecurity services, helping organisations align strategy, value and risk.", "email" : "contact@digitalfrontierpartners.com", "knowsAbout" : [ "Enterprise AI enablement", "Artificial intelligence strategy", "AI governance and risk", "Workforce optimisation", "Cybersecurity", "Technology due diligence", "Digital transformation" ], "logo" : { "@type" : "ImageObject", "contentUrl" : "https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp", "height" : 342, "width" : 1200 }, "name" : "Digital Frontier Partners", "telephone" : "+61 1800 288 817", "url" : "https://digitalfrontierpartners.com.au/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://digitalfrontierpartners.com.au/#website", "@type" : "WebSite", "inLanguage" : "en-AU", "name" : "Digital Frontier Partners", "publisher" : { "@id" : "https://digitalfrontierpartners.com.au/#organisation" }, "url" : "https://digitalfrontierpartners.com.au/" } ```