Checkmarx

EY Confirms Data Breach Exposing Goldman Sachs and Man Group Client Details via Checkmarx Vulnerability

EY has confirmed a data breach involving client documents accessed through a third-party technology services management platform used to support its tax operations. The unauthorized access occurred via a vulnerability in Checkmarx software and lasted from March 28 to April 12, with detection only on April 23. Exposed information included names, addresses, tax identification numbers, email addresses, and financial details belonging to clients in Goldman Sachs wealth management and the Man Group investment fund. Neither Goldman Sachs nor Man Group systems were compromised, confirming the exposure originated solely from EY's environment. The leaked materials consisted of attachments from support tickets rather than core system data. EY has engaged independent security firms, notified regulators in California, Texas, Massachusetts, and Vermont, and offered credit monitoring to affected individuals.

TRON, Aptos and BSC in One Infection Chain: JavaScript Loader Linked to ChainVeil Campaign

Researchers at Checkmarx examined the ChainVeil campaign that used npm packages to distribute multi-stage JavaScript loaders. A newly discovered sample appeared in a GitHub repository recommended by an AI agent, where the file navigation.js contained an obfuscated loader that matched the campaign's techniques. The loader retrieves encrypted payloads from TRON, falls back to Aptos, and then uses the extracted data as a BSC transaction identifier to fetch the next stage. C2 infrastructure and final RAT functionality aligned exactly with previously published indicators, except for the campaign identifier A9-0554-3 instead of the A6-* markers seen in npm samples. Git history showed the malicious code was inserted via a merge commit on 29 March 2026, months before the first known npm packages appeared in May. The findings indicate that npm was never the only distribution channel for ChainVeil and that the campaign's blockchain-based delivery mechanism has been active since at least early 2025.