Speed, Trust, and the Compromised Workbench
From uncovering how attackers are collapsing timelines and exploiting trust relationships, to turning developer environments into the fastest path to full compromise, this week’s conversation looks at where defenders still have room to slow them down.
This week’s conversation focuses on a shift that cuts across cloud, software, and user behavior: attackers are not just getting in, they’re moving from foothold to control much faster than most security programs are built to handle.
In this episode, the team looks at several recent examples of that compression in action, from a supply chain compromise that led to AWS admin access, to malware spreading through GitHub, npm, and VS Code, to ClickFix lures that convince technical users to run malicious commands themselves. Along the way, they also dig into the role AI is playing on both sides, not as some brand new class of attack, but as a force multiplier that speeds up reconnaissance, iteration, prioritization, and response.
The common thread across these stories is not novelty for novelty’s sake. It is the way trust relationships, developer workflows, and human decisions keep giving attackers faster paths through the environment.
Key Takeaways:
UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours, The Hacker News
https://thehackernews.com/2026/03/unc6426-exploits-nx-npm-supply-chain.html
- What Matters: A supply chain compromise in a popular npm package didn’t stop at code exposure. It became a path to AWS admin access in roughly 72 hours. The chain worked because identity and trust relationships were already in place, letting the attacker move cleanly from one system to the next. Once access is overscoped, cloud environments collapse fast. Controls like alerting on new admin creation or tightening role boundaries are often the only real friction left.
- What’s Overhyped: The 72-hour timeline gets the headline. In reality, with the same level of access, that path could move faster. The issue isn’t speed alone. It’s how much control a single foothold unlocks once you’re in.
GlassWorm Malware Hits 400+ Code Repos, Bleeping Computer
- What Matters: GlassWorm spreads across GitHub, npm, and VS Code, putting the attack inside the developer workflow. That shifts the problem from perimeter defense to toolchain integrity. If the IDE or dependency chain is compromised, you inherit developer identity and access without touching production directly. This also exposes how much modern software depends on open source projects that are lightly maintained but deeply embedded.
- What’s Overhyped: Hundreds of repos make for a strong headline. The harder truth is that this model has always been fragile. Critical infrastructure still depends on small, under-resourced projects that few organizations actively support.
ClickFix: The "Human Terminal" Bypass, The Hacker News
https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html
- What Matters: This campaign tricks users into pasting and running commands in their own terminal under the guise of installing AI tools. That removes the need for an exploit entirely. The user executes the payload, which sidesteps many platform protections by design. Technical users are especially exposed because this fits how they already work.
- What’s Overhyped: There’s no clean technical control that stops this every time. Users will run things they shouldn’t, especially when the workflow feels familiar. The answer isn’t another training module. It’s assuming this happens and limiting what a compromised workstation can do next.
Microsoft: AI-Supercharged Tradecraft, TechNewsWorld
- What Matters: Microsoft highlights attackers using AI to speed up reconnaissance, iteration, and execution. The core techniques haven’t changed much, but the pace has. Attackers can test more paths, adjust faster, and reduce time between attempts. Defenders have similar capabilities, especially when it comes to processing large volumes of data and surfacing signal, but adoption often lags behind.
- What’s Overhyped: This isn’t a brand-new playbook. It’s the same kill chain running faster with less effort. The gap shows up in execution speed, not in entirely new tactics.
Google Report: The Collapsing "Patch Window", ZDNet
https://www.zdnet.com/article/google-cloud-threat-report-third-party-software-ai-attacks/
- What Matters: Google points to a shrinking window between disclosure and exploitation. In some cases, attackers are moving faster than teams can realistically patch. But many real-world compromises don’t rely on CVEs at all. Misconfigurations and identity paths still show up more often in practice, especially in cloud environments where systems are constantly changing.
- What’s Overhyped: Framing this as a patching race misses the point. Even aggressive patch cycles won’t cover the majority of paths attackers actually use. The bigger constraint is how slowly most organizations can adapt once something changes.
