Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive

On March 20, 2026 at 20:45 UTC, Aikido Security detected an unusual pattern across the npm registry: dozens of packages from multiple organizations were receiving unauthorized patch updates, all containing the same hidden malicious code. What they had caught was CanisterWorm, a self-spreading npm worm deployed by the threat actor group TeamPCP. We track this incident as MSC-2026-3271.

Camille Stewart Gloster on how AI systems can help you wade through log data and get more done

AI and machine learning are already being used in cybersecurity to help reduce the "noise of all the indicators" that security teams receive. These systems can serve as a "first line of defense" by setting up potential response actions. However, organizations need to ensure they keep human analysts in the loop because contextual knowledge and human judgment remain critical. Data Security Decoded is available on our YouTube channel!

fast-draft Open VSX Extension Compromised by BlokTrooper

The KhangNghiem/fast-draft extension, listed on open-vsx.org/extension/KhangNghiem/fast-draft and now sitting above 26,000 downloads, had multiple malicious releases that execute a GitHub-hosted downloader and pull a second-stage RAT and infostealer from the BlokTrooper/extension repository. The confirmed malicious releases in the version line we inspected are 0.10.89, 0.10.105, 0.10.106, and 0.10.112.

Cato CTRL Threat Research: Vishing and Microsoft Teams Used to Deliver PhantomBackdoor

Cato CTRL has discovered a q-based delivery technique used against an Italy-based consumer services company associated with PhantomBackdoor, a multi-stage WebSocket-based backdoor previously reported in a Ukraine-focused spear phishing operation by SentinelOne. In SentinelOne’s earlier reporting, initial access relied on phishing lures and a ClickFix-style flow that triggered a staged PowerShell and ended with a WebSocket backdoor.

Glassworm Strikes Popular React Native Phone Number Packages

On March 16, 2026, two React Native npm packages from the AstrOOnauta were backdoored in a coordinated supply chain attack. Both releases added an identical install-time loader that fetches and executes a multi-stage Windows credential and crypto stealer, triggered by nothing more than a routine npm install. The affected packages are react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8.

What Healthcare Leaders Face After a Cyberattack

In this episode of Building Cyber Resilience: A Healthcare Leader’s Guide, host Josh Howell speaks with Errol Weiss, Chief Security Officer at Health-ISAC. Drawing on decades of experience across government, finance, and healthcare, Errol walks through what leaders actually face in the hours and weeks following a cyberattack. The conversation explores why healthcare remains a top ransomware target, how uncertainty shapes recovery decisions, and why trusted, anonymous information sharing has become one of the sector’s strongest defenses.

What is Agentic AI vs GenAI?

Everyone knows ChatGPT, but Agentic AI is where the real work happens. In this Agentic AI vs GenAI breakdown, we explain why Agentic AI is the next major leap, and what it means for your business and career. Here’s the difference: Generative AI (GenAI): Creates content. You ask, it writes, summarizes, or creates. Agentic AI: Does work. It is built on three core components: a brain (reasons), memory (context), and tools (the key that lets agents touch real systems like APIs and databases).