Security news from the BlueTeamSec community for Tuesday the 22nd of September 2026, with seven stories to get through.
The Rust Foundation have put out an alert about an active campaign targeting prominent members of the Rust community and crate maintainers. The goal is to compromise publishing privileges on crates.io and push malware through the supply chain — DPRK actors are suspected, and this follows similar attacks in June and a successful compromise of the arrayref crate back in August.
And on a similar note, CloudSEK identified Ghappier, a sophisticated loader linked to DPRK's PolinRider campaign. We've been tracking activity around PolinRider since last week — this one adds detail on a supply-chain attack that briefly compromised an npm package on the 9th of September, using a four-stage payload with Ethereum blockchain for command and control. Twenty-two GitHub accounts and sixty-five repositories were involved, and the malicious code deleted itself after execution.
Researchers released antidbg, an open-source anti-debugging library for Windows that uses direct syscalls to detect debuggers and instrumentation tools without touching hookable Windows APIs. It's designed to resist dynamic analysis — the sort of technique you'll find in both legitimate software protection and, inevitably, in malware.
Trail of Bits wrote up a security audit of the Miden zero-knowledge VM where they used AI-assisted tooling to build custom analysis infrastructure. They found a high-severity flaw in signature verification that could enable account drainage, plus arithmetic bugs in core binary operations. Worth a read if you're interested in where formal verification and AI-enhanced static analysis are heading.
Palo Alto Networks identified Neural Override, a Python-based remote access tool discovered this month that uses large language models via the OpenRouter API for autonomous attack planning. It's controlled via Telegram and linked to the threat actor Xakmee, with rapid version progression suggesting AI-assisted code generation. No specific targets identified yet — the configurations are still placeholder, so this looks early-stage.
EntraTrace is a new open-source tool for tracking offensive security tools that target Microsoft Entra ID. It maps offensive tools to the API endpoints they use and their HTTP user-agent strings, giving SOC teams and incident responders a knowledge base for detecting threats in Entra environments. We covered related Entra attack research last week — this one's useful background if you're defending that surface.
And finally, a proof-of-concept framework called OneDrive-UDC2 that tunnels Cobalt Strike command and control through Microsoft OneDrive infrastructure. Does what it says on the tin — one for red teams and detection engineers alike.
That's all for today. The articles are the work of their original authors — the analysis here was automated.