[beavertail]

June 18, 2026

• DPRK-linked PolinRider continues evolving — tailwind-color-shades typosquat uses a blockchain dead-drop loader chain (TRON→Aptos→BSC→XOR→eval) to deliver Beavertail → InvisibleFerret, with a new XOR key and obfuscator build (Nextron). · Supply Chain

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel

June 17, 2026

• PolinRider/DPRK npm typosquats (tailwind-color-shades, twcompose-utils, classbreeze-utils) ship real plugins plus obfuscated droppers fetching OS-specific second stages (Beavertail → InvisibleFerret) from blockchain dead-drops and IP 194.11.226.41. Nextron Research. · Supply Chain

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists