The Watch

CyberScoop reports Amazon's researchers traced the axios, debug and chalk compromises back to a live-fire rehearsal in an obscure package called typo-crypto in March 2025. The operators then waited more than a year before escalating to high-dependency targets. They were not hunting a vulnerability. They were accumulating maintainer reputation until they held legitimate publish permissions.

Three controls failed in sequence. Composition tooling triages by download count and CVSS, so twelve months of activity below the popularity threshold produced no early warning. The publish event looked identical to every other publish from that maintainer, so no anomalous-credential signal fired. Per Cyberpresso, the payloads were multi-stage, platform-specific and conditionally activated, obfuscated deliberately to extend analyst dwell time. Sandbox detonation returns clean. IOCs land after the exposure window closes.

What actually reached the estate

The compromised axios added a dependency named plain-crypto-js. Its post-install script contacted a hardcoded command-and-control host and staged a cross-platform remote-access trojan for Windows, macOS and Linux. Wiz telemetry recorded roughly one in ten cloud environments tainted within about two hours, against axios alone drawing near 100 million weekly pulls. Nobody typed an install command at that speed. Automated dependency resolution in CI/CD did the distribution.

Propagation velocity, not download count, is now the correct blast-radius metric for a supply-chain event.

Where the sources agree, and where the work gets expensive

Cyberpresso and CyberScoop reach the same conclusion. The failing control was maintainer identity hardening, not scanning. Both push the hunt past the dependency graph into the build plane. CI runners hold cloud credentials, npm tokens and signing keys with the thinnest telemetry in the estate. That multiplier is what the operator was buying. CyberScoop recommends extending the hunt window 18 months or more, on account of the March 2025 rehearsal.

One divergence matters operationally. Cyberpresso frames this as patch-and-freeze driven by Amazon Inspector advisories and OSV. CyberScoop frames it as a compromise assessment with no clean closure criterion. Take the second framing. Pinning to known-good versions does not clean poisoned container images already sitting in the registry, and it does not revoke a token a post-install script has already read.

The control that would have caught it

A mandatory 7-to-14 day version-adoption cooldown in an internal registry proxy converts a zero-day supply-chain push into a detectable event before it reaches a build. Paired with npm ci --ignore-scripts as the CI default and integrity-verified lockfile pinning, it is the cheapest structural answer available, and it works against the next hijacked maintainer, whose name is not yet public.

Ulej is an identity-theft tool rather than a mail-theft tool, and the remediation problem follows from that. Per Risky.Biz, the loader arrives through the CSS @import feature of Zimbra's stored XSS flaw. It harvests session tokens, backup 2FA codes, browser-saved passwords and ninety days of mailbox contents. Session tokens bypass authentication. Backup 2FA codes bypass MFA. Browser-saved passwords leave the Zimbra boundary entirely and work anywhere those users reused them.

The dwell figure is the number to brief upward. The flaw was patched in November 2025. The campaign traces to at least July 2025. That is four months of undetected zero-day operation, which means a ticket reading "patched, closed" describes an injection path that is shut against everyone except the operator already holding the credentials.

The OWA development breaks a playbook step

The Hacker News reports the same Russian state-linked set exploiting a Microsoft OWA flaw that preserves mailbox access after credential rotation, with US entities among the targets. That does more than grant access. It converts the most common containment action in the average email-compromise runbook into a false-negative generator. Where the last such incident was closed on password-reset evidence, the correct assumption is that the intruder is still reading mail.

Revoke tokens before you reset passwords; the reset contains nothing an attacker with a live refresh token cares about.

The pattern across sources

Three independent reports converge on the same structural point from three different products. Risky.Biz: stolen tokens survive a Zimbra patch. The Hacker News: mailbox access survives rotation on OWA. Cyberpresso, documenting Noma Security's finding in an unrelated domain, shows that a patched redeploy does not undo poisoned agent memory, because the backdoor sits in state rather than in code. Persistence has migrated into artefacts that patching and rotation were never designed to invalidate.

Platform choice is not the variable. Russian actors rotating from Zimbra to OWA is one sustained mailbox-collection campaign in which the product is interchangeable, so detection content keyed to a single CVE signature expires at the campaign's next migration. Key it to mailbox behaviour instead: access after a rotation event, unusual sync clients, bulk EWS or Graph pulls, newly created forwarding rules.

One consequence sits outside security. If a closed incident is in fact ongoing, the breach-notification clock was mis-set. Privacy counsel goes in before the retro-hunt produces a hit, not after.

Start with the timeline, because it invalidates the premise of a severity-based queue. Risky.Biz reports that CVE-2026-16723, an unauthenticated remote code execution flaw in Alibaba's Fastjson, moved from FearsOff's disclosure to mass exploitation in roughly one day. Imperva and ThreatBook documented it in the wild. No patch SLA measured in days survives that. Inventory speed is the only variable left, and Fastjson is the hardest inventory question there is. It arrives transitively, through frameworks, SDKs and vendor JARs, in Java services nobody has touched in three years.

The scores are missing where exploitation is confirmed

Per SANS AtRisk, four of the five KEV additions between 21 and 27 July carry a CVSS score of 0. Those are the WordPress Core interpretation-conflict and SQL injection flaws, VeloCloud Orchestrator on-prem, and CVE-2021-27137, a five-year-old DD-WRT stack overflow under active exploitation. Their scored sibling is CVE-2026-16232 in Check Point SmartConsole at CVSS 9.1, an authentication bypass granting full administrative privileges, including the ability to modify security policy. In that scenario the attacker does not evade the controls. The attacker writes them.

Cisco's advisory shows the inverse failure. Cyberpresso reports CVE-2026-20316 at a 5.3 base score, from static credentials in the Secure Firewall Management Center web interface. Cisco manually elevated it to High because it chains to elevated privileges. PSIRT reports it as already exploited. A threshold-driven SLA files an actively exploited bug in the firewall management plane behind routine work. Cisco supplies one IOC: a /var/tmp/license.tmp entry in the logs. Check that first. It determines whether this is patching or incident response.

The target set is the tooling itself

Compromising the tools that watch the network yields maximum leverage, and the exploit tooling is commoditised. SANS notes ESAFENET DLP default credentials published in a 2023 nuclei template are under active scanning. Against volume like Oracle's July update addressing 1,449 vulnerabilities and Apple's 187 CVEs, no severity threshold produces a defensible queue. One line of policy does. KEV first, unscored entries included by default.

Two stages, both reusable against every assistant deployed. Stage one is indirect prompt injection: instructions embedded in a Word document that a user hands to Microsoft 365 Copilot for summarisation. The document does not exploit Word. It exploits Copilot's willingness to read document content as instructions. Stage two is egress. Rubrik researcher Ori Lahav found a flaw that lets the assistant reach the internet from inside its supposedly air-gapped code sandbox. Injection supplies execution, the sandbox flaw supplies egress, and Copilot's own Graph permissions supply the data.

The detection gap is the finding, not the flaw

Per Rubrik's Joe Hladik, the exploit would not look like suspicious activity in Copilot's logs. Microsoft pointed at Purview for Copilot activity and declined to say whether Purview captures the sandbox behaviour Rubrik flagged. Nothing fires. No malware on the endpoint, so EDR sees nothing. No anomalous credential use, so identity analytics sees nothing. No unusual outbound connection from the corporate network, because the traffic originates inside Microsoft's cloud. The stack is watching the wrong side of the boundary.

Microsoft says it is unclear whether any customers were impacted — a statement the telemetry gap makes it structurally unable to support either way.

Rubrik puts scope at any file or email anywhere in the target's Microsoft 365 estate plus connected cloud servers, across all 20 million-plus corporate Copilot customers. There is no CVE, no CVSS and no public KB. Vulnerability programmes never saw it and cannot evidence remediation. A second flaw, from a different firm, is being withheld from publication because its patch status is unclear.

Cross-source corroboration and one caution

The Information reports new Copilot flaws leaking customer secrets independently, with mitigation living in SharePoint permission hygiene and grounding scope rather than a patch cycle. The Hacker News documents a related integrity variant: a Copilot-for-Word injection that rewrites figures in a report and copies its own instructions into the output file, disclosed 144 days after the initial report. Sources diverge on framing. One argues the network is becoming the control plane for AI security, and its own facts refute that. Document-borne injection and poisoned agent state are invisible to network inspection.

Patching is not available, so it is not the lever. The levers are data-reach reduction, capability removal, ingress detection and contractual evidence, in that order. Copilot's blast radius is set by its permission scope, not by the document. Restricted SharePoint Search, the removal of org-wide sharing links, and encrypted sensitivity labels on legal, HR, M&A and source repositories mitigate flaw two and every flaw not yet disclosed. Then hunt delivery: OOXML files with zero-opacity or white-on-white text runs, HTML comments, long base64 blobs and instruction-shaped strings arriving from external senders to high-privilege roles.