> InfoSec News Nuggets 02/05/2026

The Notepad++ supply chain attack — unnoticed execution chains and new IoCs Kaspersky details multiple distinct infection chains observed in the Notepad++ update compromise, including rotating C2 infrastructure, changing delivery tooling, and targeting a small set of victims rather than broad distribution. The write-up highlights how legitimate updater execution was abused to run attacker-controlled installers and stage follow-on payload delivery. It also includes hunting ideas (process artifacts, unusual domains, and command execution patterns) to help defenders spot related activity in enterprise telemetry.   Microsoft Office zero-day lets malicious documents slip past security checks A high-severity Microsoft Microsoft Office issue (CVE-2026-21509) is being exploited to bypass document security checks tied to COM/OLE protections, enabling malicious attachments to run despite built-in mitigations. The article emphasizes that exploitation hinges on convincing a user to open a crafted file, but the in-the-wild status makes patch urgency high. If you have Office versions in scope, treat this as an emergency update and prioritize endpoints with higher phishing exposure.    Critical React Native Vulnerability Exploited in the Wild Threat actors are exploiting a critical flaw tied to React Native tooling (the “Metro4Shell” narrative around CVE-2025-11953) where dev servers can be exposed externally, enabling unauthenticated remote command execution in certain configurations. Reporting indicates real-world exploitation activity, including multi-stage loaders and attempts to disable endpoint protections. The main operational takeaway is to ensure Metro and related dev services are not bound to externally reachable interfaces, and to scan for unexpected exposure in build and test environments.   DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files A newly reported campaign (“DEAD#VAX”) uses phishing to deliver VHD files hosted via IPFS and focuses on heavy script obfuscation, runtime decryption, and in-memory injection to reduce on-disk artifacts. The payload chain ultimately installs AsyncRAT, aiming to blend into normal Windows process activity. This is a reminder to treat disk-image attachments and shortcut style execution paths as high-risk, and to review controls around mounting VHDs and script execution telemetry.    Open-source attacks move through normal development workflows A summary of a ReversingLabs study argues that open-source malware increasingly rides “normal” development mechanics: dependency automation, routine updates, and trusted registries. It calls out npm as a major distribution channel and highlights how compromised maintainer accounts and automated pull requests can amplify blast radius. It also points to persistent secrets exposure in packages and emerging abuse of AI-related tooling and artifacts as additional supply chain risk.    Panera Bread breach impacts 5.1 million accounts, not 14 million customers Panera Bread account exposure was revised to roughly 5.1 million accounts after analysis by Have I Been Pwned, despite earlier reporting centered on a larger “records” number. The write-up attributes access claims to ShinyHunters and describes leaked data and indicators the compromise may have involved a Microsoft Entra ID SSO code obtained via vishing tactics. Treat this as another signal that identity workflows and helpdesk verification paths remain a top attacker focus, especially around SSO reset and token handling.    Cantwell Demands AT&T, Verizon CEOs Come Clean on Salt Typhoon Hacks, Ongoing Network Security Risks A February 3 press release says Sen. Maria Cantwell is pushing for an oversight hearing with AT&T and Verizonleadership, citing lack of transparency and continued concern about the Salt Typhoon intrusion. The release references ongoing risk concerns, including suggestions that the threat may still persist in telecom environments and that documentation requested by Congress was not provided. It also cites FBI characterization of broad targeting and reiterates the emphasis on stronger verification and “basic hygiene” expectations for major providers. The post InfoSec News Nuggets 02/05/2026 appeared first on AboutDFIR - The Definitive Compendium Project.