Three separate reports landed this week, each describing a different attack style. One is a supply chain compromise of a JavaScript library used by most of the web. Another is a cybercrime group that calls employees and talks its way into networks. The third involves fake AI assistants that install malware. None of these are new concepts, but the details matter.
The axios supply chain attack and its BlueNoroff connection
Kaspersky's GReAT team published its analysis of the March 2026 compromise of axios, the HTTP client with over 100 million weekly downloads on npm. An attacker took over a lead maintainer's npm account and published malicious versions of the package. The malicious code added a hidden dependency called plain-crypto-js that ran a postinstall script. That script deployed a cross-platform remote access trojan on macOS, Windows, and Linux.
What makes this interesting is the attribution work. Kaspersky found technical overlaps with two known BlueNoroff campaigns, GhostCall and GhostHire. BlueNoroff is a subgroup of the Lazarus Group that focuses on stealing cryptocurrency. The overlaps include a shared user agent, a module name string "webT", the use of SyphonV2 loader, and infrastructure that appears in both the axios attack and the earlier campaigns. Kaspersky is careful to say this is not definitive attribution. Threat actors can reuse code, and attackers can deliberately copy characteristics to mislead researchers. That caveat is correct, and I appreciate that they put it in the report.
For defenders, the takeaway is not about who did it. It is about how the attack worked. A postinstall script in an npm package can execute arbitrary code. Most package managers run those scripts by default. If you install dependencies without inspecting what they do, you are trusting every maintainer account that owns a package in your dependency tree. The axios incident is a textbook example of why that trust is fragile.
What you can do: pin exact versions, use lock files, and consider disabling lifecycle scripts if your environment allows it. npm has a flag for that. Also monitor your dependency tree for new or unexpected packages. The attack added a dependency that no legitimate version of axios needed. That kind of anomaly is detectable if you are watching.
BlackFile and the persistence of voice phishing
Google Threat Intelligence Group tracks a group called BlackFile, also known as UNC6671. It has been active since the start of the year and targets private equity firms, law firms, and financial rating agencies. The group impersonates IT support in voice phishing attacks. Austin Larsen, a principal threat analyst at GTIG, told CyberScoop that BlackFile is "big-game hunting." It goes after the largest organizations in each sector, not small companies.
The group has split its extortion operations across four brands: Redact, Pink, Helix, and Falcon. All of them share infrastructure. Extortion demands start around $3 million and are typically negotiated down to less than $1 million. The group targets an average of 1.5 new victims per day. It has recently escalated to swatting incidents, which is a tactic borrowed from criminal networks. Mandiant has been engaged by more than two dozen organizations that BlackFile successfully compromised since January.
Voice phishing is not sophisticated. It relies on humans answering the phone and trusting a caller who says they are from IT support. The attackers use hundreds of callers, often lower-level people recruited for a small fee or goodwill with the group, to make the initial calls. Less than a dozen core operators coordinate the different brands. The pattern is the same one used by many cybercrime groups: talk someone into revealing credentials or installing remote access software.
The lesson here is that technical controls do not stop social engineering. You can have the best endpoint detection and the best network segmentation, but if an employee gives an attacker a password or approves a multi-factor prompt, none of that matters. Training has to go beyond annual compliance videos. Run phishing simulations that include phone calls. Establish a policy for verifying IT support requests through a separate channel, like a ticket system or a known internal web page. And make sure your help desk staff know that they should never ask for or accept credentials over the phone.
SilverFox uses fake Claude apps to target APAC organizations
Kaspersky GReAT also reported on SilverFox, an advanced persistent threat group active across the Asia-Pacific region. The group has been around for a while, but its recent campaigns use fake versions of Anthropic's Claude assistant for Windows, macOS, and Linux. The fake apps are distributed through fake websites, phishing emails, and files shared over messaging apps. The goal is to inject malware that enables long-term espionage and data theft.
SilverFox's campaign in early 2026 sent over 1,600 malicious emails in January and February. The emails posed as tax audit notifications, asking recipients to download an archive that supposedly contained a list of tax violations. The group's main target is Greater China, which accounts for over 90% of its attacks. Manufacturing is the most targeted industry, followed by IT and services.
What is new here is not the phishing. It is the use of a legitimate AI brand as bait. Social engineers have always used trusted names, but the rapid adoption of AI tools in the enterprise gives them a fresh set of lures. A fake Claude installer looks like a normal download to an employee who wants to use the model in their workflow. The fact that the group builds versions for all three major desktop operating systems shows they expect to hit a wide range of environments.
Kaspersky also highlighted a few AI-driven attack examples. One is JADEPUFFER, an LLM-driven ransomware attack disclosed by Sysdig. The AI agent analyzed a failed attempt, changed its approach, and launched a new attack in 31 seconds. That speed outpaces most human response teams. Another example is ChatGPhish, an indirect prompt injection technique where malicious instructions are hidden in webpages. When a user asks an AI assistant to summarize a page, the assistant can be tricked into following the embedded instructions. VoidLink is a cloud-native malware framework that uses generative AI to reduce the effort required to write malware. These are not theoretical; they are active research findings.
What to do with this information
These three stories share a common thread: trust is the attack surface. The axios compromise abused the trust developers place in package maintainers. BlackFile abuses the trust employees place in phone calls. SilverFox abuses the trust people place in known software brands. No amount of patching or monitoring can fully protect you from a social engineer who has a believable story and a motivated target.
That means the priority is to reduce the blast radius of any single compromise. Use zero trust principles. Verify access requests instead of automatically trusting anything inside your network. Segment environments so that a compromised workstation does not give direct access to the entire data center. Enforce multi-factor authentication with hardware keys or authenticator apps that require user interaction. For supply chain, use dependency lock files and scan for unusual postinstall scripts. For voice phishing, train staff to hang up and call back through a known number.
The AI angle is more concerning because it scales. JADEPUFFER shows that an AI agent can adapt in seconds, which is a fundamental speed advantage over human defenders. Your detection tools need to be automated too. The best response is to deploy your own AI-based detection that can correlate events and respond without waiting for a person to look at a dashboard.
None of this is easy, but the evidence from this week's findings is clear: the attackers are not slowing down, and they are using every tool available, including AI, to get in. Your job is to make it as expensive and as difficult as possible for them to succeed.