Emerging Threats//
TeamPCP Supply Chain Attacks
TeamPCP is exploiting trusted npm and PyPI packages to compromise developer environments, steal credentials, and extend attacks across software supply chains.
In this post, SpiderFoot founder and CEO Steve Micallef talks about the importance of leveraging a broad spectrum of OSINT for managing your attack surface:
…when determining the attackable surface of an organization, we must not only care about externally exposed assets, but also externally exposed information relevant to that organization. Such information (OSINT) can be used by attackers to mount social engineering attacks, spear-phishing attacks, gain access to critical assets sitting outside the traditional network perimeter or simply get more efficient about what assets they should seek out once inside.
Read the post in full here.