Daily Security Briefing #214

April 4, 2026 | Read Online

Social engineering campaigns target Node.js maintainers, LinkedIn accused of covert surveillance, and AI training data poisoning…

Executive Summary

Cybersecurity threats continue to escalate with malicious actors adapting to disruptions. A recent social engineering campaign targeting top-tier Node.js maintainers highlights the need for robust security measures in software development. Meanwhile, a massive covert surveillance operation has been uncovered on LinkedIn, scanning users’ computers without consent. Additionally, AI training data poisoning remains a growing concern.

Top Articles

Axios npm hack used fake Teams error fix to hijack maintainer account The maintainers of the popular Axios HTTP client have published a detailed post-mortem describing how one of its developers was targeted by a social engineering campaign believed to have been conducted by North Korean threat actors. BleepingComputer

Hackers Launch Social Engineering Offensive Against Key Node.js Maintainers Following the high-profile supply chain compromise of the widely used Axios package, a highly coordinated social engineering campaign has been uncovered targeting top-tier Node.js and npm maintainers. GBHackers

Claude Code Leak Exploited by Hackers to Deliver Vidar and GhostSocks Threat actors are actively exploiting a recent source code leak of Anthropic’s Claude Code by using fake GitHub repositories to distribute Vidar and GhostSocks malware. cyberpress

LinkedIn Accused of Secretly Checking Devices for Installed Applications Security researchers have uncovered a massive covert surveillance operation reportedly run by Microsoft-owned LinkedIn. According to a new investigation named BrowserGate, LinkedIn executes hidden code on user devices to scan for installed software and browser extensions. cyberpress

Device code phishing attacks surge 37x as new kits spread online Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged more than 37 times this year. BleepingComputer

European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack Hackers stole over 300GB of data from the Commission’s AWS environment, including personal information. SecurityWeek

That dream job offer from Coca-Cola or Ferrari? It’s a trap for your passwords We uncovered two job scams posing as legitimate offers from Coca-Cola and Ferrari that could pry into Google and Facebook accounts. Malwarebytes

Updated OSINT VM We just pushed several updates to the OSINT VM thanks to @jknsec: Updated linux.txt and install.sh to reflect changes within several applications. Modified user.sh to reflect change with Maigret. IntelTechniques

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.