Ethersphere's bee-js and Swarm Desktop Hit by Supply Chain Attack Delivering Wallet-Stealing Malware

Attackers Abuse Qubole Trusted AWS Roles to Breach Customer Accounts and Exfiltrate Secrets

Between October 14 and October 26, an attacker used credentials belonging to Qubole's own AWS account to assume IAM roles in multiple customer environments and steal secrets and data. The compromise affected organizations that had previously connected the Qubole data lake platform, owned by Idera, to their AWS accounts via cross-account role trust policies. Security researchers at Wiz discovered the activity after Sentra flagged suspicious AssumeRole calls from the account ID 805246085872. The attacker enumerated unused roles, read Lambda environment variables, Secrets Manager entries and SSM Parameter Store values, then validated stolen credentials with TruffleHog before copying data from accessible S3 buckets. A separate, unrelated campaign between October 8 and 11 used customer-supplied AWS access keys also configured for Qubole. Wiz has published detailed CloudTrail hunting queries covering the period from October 1 onward and recommends immediate rotation of secrets and removal of unnecessary Qubole roles.

Cyberattack on French Blood Service Refrigeration Systems Alters Plasma Storage Temperatures

Three sites of the Établissement français du sang (EFS) suffered a cyber intrusion targeting refrigeration equipment supplied by an external vendor. Attackers remotely modified temperature setpoints and defrost cycles in cold storage chambers holding plasma for transfusions and derived medicines. Rapid detection by EFS monitoring systems allowed technical teams to isolate affected units and transfer products, preventing any loss or quality degradation. The incident follows similar attacks in October 2026 on French supermarket chains including Intermarché, Netto, Leclerc and Super U, where Danfoss controllers were manipulated to extreme defrost values up to 99 °C. Comparable anomalies were also reported at U.S. military retail facilities linked to the Pentagon in August 2026. The pattern highlights risks when industrial control systems for critical cold-chain infrastructure are exposed through third-party vendors.

Homebrew Maintainer Slams Google Over Malicious Ads in Binance Supply Chain Breach

Homebrew project maintainer Mike McQuaid publicly criticized Google for failing to remove malicious advertisements that led to the compromise of a Binance engineer. The attack began when the Wallet DevOps engineer searched for the legitimate Homebrew package manager and clicked a sponsored result that delivered a trojanized installer. The malicious binary installed MacSync Stealer, exposing credentials and infrastructure details that attackers later used in a multi-stage campaign against the cryptocurrency exchange. Binance confirmed the initial vector was a supply-chain compromise rather than the widely reported fake job application. McQuaid stated that Homebrew has warned Google about the abuse of its name in paid ads for years, accusing the company of prioritizing revenue from malware distributors. The incident highlights ongoing risks to open-source package managers when search engines display unvetted sponsored links above official project sites.