# High Profile Threats

Published articles for High Profile Threats.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

DevFeed: [Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)](<https://devfeed.tech/articles/threat-brief-mitigating-large-scale-credential-attacks-updated-august-18-7754.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/large-scale-credential-attacks/>)

Author: Unit 42

Published: 2026-08-18T19:05:33Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [password spraying](<https://devfeed.tech/topics/password-spraying.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>)

Tags: [credential-based-attacks](<https://devfeed.tech/tags/credential-based-attacks.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [general](<https://devfeed.tech/tags/general.md>), [high-profile-threats](<https://devfeed.tech/tags/high-profile-threats.md>), [identity](<https://devfeed.tech/tags/identity.md>), [incident](<https://devfeed.tech/tags/incident.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [password-spraying](<https://devfeed.tech/tags/password-spraying.md>), [thehatman](<https://devfeed.tech/tags/thehatman.md>)

### AI overview

This threat brief examines large-scale credential attacks, including password spraying campaigns and claimed credential theft from Microsoft Entra tenants. It provides guidance for identifying suspicious login activity, auditing remote access logs, and hardening internet-exposed edge devices.

### Source excerpt

In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42.

## ChainDrop: Inside a Self-Propagating npm Worm

DevFeed: [ChainDrop: Inside a Self-Propagating npm Worm](<https://devfeed.tech/articles/chaindrop-inside-a-self-propagating-npm-worm-7748.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/>)

Author: Unit 42

Published: 2026-08-06T22:26:39Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [ChainDrop](<https://devfeed.tech/topics/chaindrop.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Ethereum](<https://devfeed.tech/topics/ethereum.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [blockchain](<https://devfeed.tech/tags/blockchain.md>), [c2](<https://devfeed.tech/tags/c2.md>), [chaindrop](<https://devfeed.tech/tags/chaindrop.md>), [ci](<https://devfeed.tech/tags/ci.md>), [claude-code](<https://devfeed.tech/tags/claude-code.md>), [developer-tooling](<https://devfeed.tech/tags/developer-tooling.md>), [ethereum](<https://devfeed.tech/tags/ethereum.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [high-profile-threats](<https://devfeed.tech/tags/high-profile-threats.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [malware](<https://devfeed.tech/tags/malware.md>), [security](<https://devfeed.tech/tags/security.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

### AI overview

This article analyzes ChainDrop, a self-propagating npm worm that infected more than 400 packages and threatened developer workstations, CI pipelines, cloud environments and downstream users. It describes credential and token theft, GitHub Actions runner memory extraction, package republishing, persistence through developer and AI coding tools, blockchain-based C2 resolution, and C2 reconfiguration through an Ethereum transaction.

### Source excerpt

Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42.