Sable Index

[DEVELOPING · MALWARE] npm worm poisons 2,234 package versions across 444 names A credential-stealing worm spread through npm on August 4, republishing poisoned releases across 12 unrelated organizations. SafeDep confirmed 2,234 malicious versions across 444 package names, including dependencies used by ESLint. The payload runs during npm install and steals GitHub, cloud, registry tokens and private keys from developer and CI environments. @SableIndex | @SableIndexDiscussion

🎉 Pool Float | Alpaca | Onyx Black 🎉

To Participate: • Join @SableIndex • Join @SableIndexOTC • Tap Participate

⬜ Participants: 62 Winners: 1 Giveaway Ends In: 2d 14h 48m

[CRIME] Ex-LAPD Officer Gets Life Plus 15 Years for Bitcoin Robbery Former LAPD officer Eric Halem was sentenced to life plus 15 years after a jury convicted him in a violent Koreatown home invasion. In December 2024, Halem and three men posed as police, restrained a 17-year-old and threatened to kill him for a hard drive holding $350,000 in Bitcoin. A judge rejected Halem’s request for a new trial; he remains charged in another crypto robbery. @SableIndex | @SableIndexDiscussion

[DEVELOPING · BREACH] Swiss Federal Office for Information Technology hacked, 200 accounts compromised Switzerland’s Federal Office for Information Technology and Communications (BIT) confirmed that hackers compromised about 200 accounts on its on-premises SharePoint servers. The agency blocked Internet access and began reinstalling servers after detecting anomalous access. @SableIndex | @SableIndexDiscussion

[RANSOMWARE] Interlock abuses memory tools to exploit Cisco firewall flaw Sophos said August 4 that Interlock used legitimate memory-forensics tools while exploiting a previously undisclosed Cisco firewall flaw. On one Windows endpoint, attackers used Volatility3 and WinPmem to extract NTLM hashes and cached domain credentials. The group reached the domain controller in just over 26 hours after initial access. Sophos tracks Interlock as GOLD EMBRACE, a double-extortion crew targeting critical infrastructure, healthcare and education. @SableIndex | @SableIndexDiscussion

[ANALYSIS · CRIME] Audi Gang: Europe’s High-Speed ATM Bombers The “Audi Gang” was never a single organisation with a known leader and formal membership. Investigators used the name for overlapping, largely Dutch-based crews that crossed into Germany, destroyed cash machines and escaped in stolen high-performance Audis.

Their operations followed a disciplined pattern. One group obtained a vehicle, another prepared explosives, while drivers and demolition specialists carried out the attack. The crews often targeted ATMs at night, collected the cash and returned across the border before local police could coordinate a pursuit. Early attacks used gas to rupture cash machines. Later crews adopted solid explosives, producing far more destructive blasts. Buildings were damaged, residents were endangered and the cost of repairs sometimes exceeded the stolen cash. Investigators treated several attacks as attempted homicide because people were inside or near the affected properties. A major German-Dutch operation in February 2023 resulted in nine arrests. Eurojust attributed 31 explosions in Bavaria alone to the investigated network, with approximately €3.4 million stolen and €4 million in damage. A broader independent account connected the investigation to 52 suspected attacks and €5.2 million in proceeds. Police seized prepared explosives, cash, phones, navigation equipment, luxury clothing and expensive watches. Despite recurring online claims, the public reports do not document Bitcoin wallets, exchange accounts or blockchain tracing. Cryptocurrency laundering may sound plausible, but it remains unproven in this case. The immediate consequence was a stronger cross-border response. German, Dutch, Belgian and French authorities began treating ATM explosions as organised international crime rather than isolated robberies. Investigators formed specialised teams, coordinated extraditions and shared evidence across jurisdictions.

The Audi Gang label survives, but it can be misleading. Arresting one crew did not dismantle a single criminal hierarchy. It disrupted a repeatable business model that other groups could copy. The lasting legacy is therefore less about one famous gang and more about how mobile criminal networks exploited borders, fast cars and differences in national policing. @SableIndex | @SableIndexDiscussion

[BREACH] Intermarché says cyberattack exposed 287,605 customer records Intermarché said August 4 that a cyberattack exposed data from 287,605 customers of its online grocery service. Names, phone numbers, addresses, birth dates, loyalty-card numbers and order details were affected; bank data, passwords and email addresses were not. @SableIndex | @SableIndexDiscussion

[MALWARE] XCSSET Spreads Through Xcode Projects and Hijacks Chrome A new XCSSET variant is spreading through compromised Xcode projects and GitHub repositories, infecting developers when they build downloaded code. Unit 42 says the campaign hid in projects tied to dozens of legitimate apps with thousands of active users. Its 17 modules steal credentials and browser data; a new Chrome hijacker can intercept sessions, while a Telegram trojanizer replaces the desktop app. @SableIndex | @SableIndexDiscussion

[MALWARE] Octagon Android RAT disguises itself as Bahrain’s BH Alert app Zimperium said August 4 that Octagon, an Android remote-access trojan, is targeting users through a fake Bahrain Civil Defense app. After victims grant Accessibility access, the malware can capture screen text, log keystrokes, steal credentials and read SMS messages. It uses encrypted, dynamically loaded payloads and persistent command-and-control traffic to evade static scanners. @SableIndex | @SableIndexDiscussion

[CRIME] Philippines charges three minors over school threat videos Philippine authorities reported August 3 that three minors had been charged over social-media threats targeting students and staff at five Angeles City schools. Police said two other minors were also arrested in related bomb-hoax cases. Since May, officers handled 47 school bomb-threat reports across Central Luzon; all were hoaxes that disrupted classes and diverted resources. @SableIndex | @SableIndexDiscussion

[CRIME] Tycoon2FA developers arrested after 96,000 phishing victims Singapore Police reported August 4 that Pakistan arrested two alleged Tycoon2FA developers after a joint investigation with Interpol. The arrests occurred June 25 and July: the platform sold phishing infrastructure for monthly fees, enabling customers to clone websites and steal login credentials. Investigators seized a laptop, two computers and six mobile phones. @SableIndex | @SableIndexDiscussion

[AI] INTERPOL links AI to 55% of Africa’s reported cybercrime INTERPOL’s African Cyberthreat Assessment, released August 3, says AI enabled 55% of reported cybercrime across Africa. The report draws on surveys from 36 member countries. It links AI-facilitated scams, credential harvesting and automated social engineering to losses that more than doubled, from $192 million to $484 million. INTERPOL also records 600,000 sextortion detections and says 72% of surveyed countries reported scam centres. It calls for shared data and stronger AI skills in law enforcement. @SableIndex | @SableIndexDiscussion

[DEVELOPING · MALWARE] Fake Bank of America emails install hidden ScreenConnect access Huntress disclosed August 4 that fake Bank of America emails are installing ScreenConnect, a remote-access tool, on Windows PCs. Victims download “Account Guard,” a fake security tool. Its scripts decode a payload, bypass Windows’ elevation prompt and hide the service under “Windows Security.” Mac visitors receive a credential and identity-data phishing page. Huntress says the campaign remains active. @SableIndex | @SableIndexDiscussion

[DEVELOPING · MALWARE] Leaked DarkSword kit fuels iOS credential-theft campaign Censys found an unknown Chinese-speaking actor using leaked DarkSword code across more than 100 web properties to steal iOS users’ credentials. The sites mostly mimic AWS sign-ins: booby-trapped pages target iOS 18.4–18.7 with now-patched flaws and deploy GHOSTBLADE, an infostealer targeting keychain, iCloud and Wi-Fi credentials. Researchers linked the operation to three control panels and hosts in Hong Kong, Singapore and elsewhere. Attribution remains unconfirmed. @SableIndex | @SableIndexDiscussion

[UPDATE] The FBI agent accused of draining $900K in crypto also left clues in his ChatGPT history. According to court documents, Yaroch asked ChatGPT how to move to Europe with around $1M and received a relocation plan. The conversations later became part of the evidence against him. @SableIndex | @SableIndexDiscussion

[BREACH] South Korea restricts Lotte Card after mass breach South Korea’s Financial Services Commission has barred Lotte Card from signing up new customers until September 15 and fined it $3.5 million. The partial suspension began August 1, following last year’s breach affecting almost three million customers. Existing cardholders can still apply for and use all card services. @SableIndex | @SableIndexDiscussion

[DEVELOPING · BREACH] Cyberattack exposes Liechtenstein beneficial-ownership register data Liechtenstein said on August 3 that a cyberattack accessed its beneficial-ownership register, exposing data tied to about 31,000 people. Authorities took the system offline and formed a crisis unit after detecting the intrusion last Thursday. The register covers people behind companies, foundations and trusteeships, and supports anti-money-laundering and counter-terrorist-financing controls. Officials said there is no evidence that records were altered or deleted; the investigation is ongoing. @SableIndex | @SableIndexDiscussion

🎉 Hypno Lollipop NFT | Frozen 🎉

Requirements: • Join @SableIndex • Join @SableIndexOTC • Send 15 messages in @SableIndexOTC during the giveaway (15 messages = 1 ticket, max 5)

⬜ Participants: 61 Giveaway Ended 🍑 Winners: • @burainsaan

[FRAUD] UP police arrest three over cross-state money-doubling scam Uttar Pradesh Police arrested three men on August 4 in connection with an Instagram and WhatsApp scheme promising to double targets’ money. The arrests followed complaints from people whose bank accounts were frozen after fraudulent transfers. Police linked the operation to complaints in at least five states, including Madhya Pradesh, Rajasthan, Maharashtra and Jammu and Kashmir. Police recovered forged Aadhaar cards, a fake Delhi Police identity card, phones, ATM cards and bank passbooks. @SableIndex | @SableIndexDiscussion

[CONFIRMED · MALWARE] DOUBLECUP buries malware inside browser-cached images SOCRadar has uncovered DOUBLECUP, a paid ClickFix service that conceals malicious code inside PNG files cached by victims’ browsers. Its fake CAPTCHA pages deliver CountLoader to Windows and macOS systems, while Windows targets may also receive the DeviceManager remote-access trojan. The service, active since early June, gives operators a campaign builder and manages image hosting, encryption keys and payload rebuilding. The copied command hunts through the browser cache, extracts the hidden loader @SableIndex | @SableIndexDiscussion