Methodology

Rubrik Zero Labs analyzed more than six months of reported supply chain security incidents alongside Rubrik's own visibility into customer environments to build a structured view of how software supply chain attacks are being carried out in 2026. 

The team evaluated more than 400 software supply chain security incidents between January 1 and July 28, 2026, each labeled across a consistent schema that included threat actor, malware family, package/ecosystem, victim industry and region, financial and downstream impact, and attack methodology to support rigorous, apples-to-apples analysis across a fragmented threat landscape.Incident-level analysis is further corroborated by examining backup telemetry across customer environments in Section 3.4.

Not every incident carries a confirmed threat-actor name, dollar-loss figure, or victim industry/region tag, since attribution and impact quantification are often disclosed weeks or months after initial discovery, if at all. Percentages for these fields are calculated against the population of incidents where that field is known. Disclosed financial figures reflect confirmed, publicly reported losses. Because most organizations still do not disclose breach costs, the true financial impact of software supply chain compromise is materially larger than what is captured here.

1. Executive Summary

Between January and July 2026, the software supply chain remained the highest-leverage attack surface in enterprise security: a single compromised package, maintainer account, or CI/CD token routinely cascades into six, seven, and even eight-figure blast radii within hours. The following findings summarize Rubrik Zero Labs' analysis of more than 400 supply chain security incidents.

• The JavaScript ecosystem remains the primary vector for supply chain risk, with approximately 50.2% of incidents with a confirmed registry (156 of 311) originating from npm. This outsized presence significantly leads other distribution channels (29.3%), PyPI (7.1%), and various niche repositories. While individual package targeting is rarely repetitive, the takeover of the Axios maintainer account stands as the most critical compromise of the window, exposing a codebase with more than 100 million weekly downloads to potential malicious updates.
• The exfiltration of credentials and sensitive secrets has become the primary objective for adversaries, featuring in roughly 52.5% of incidents with a confirmed attack behavior (176 of 335). This significantly outpaces the deployment of backdoors or RATs (34.6%), self-propagating worm activity (24.2%), and data leakage events (23.0%), as well as specialized infostealers (13.4%) and ransomware (9.9%). The data suggests a strategic prioritization: threat actors are first establishing persistent administrative footholds before pursuing direct financial monetization.
• Identity and administrative credentials represent the primary attack surface: Rubrik Zero Labs identified an identity-centric component in approximately 39% of all analyzed incidents (181 of 461). This includes 51 cases involving high-leverage entry vectors like stolen npm/GitHub tokens, OAuth abuse, and maintainer-account phishing and 176 incidents where credential theft was a core objective. With 46 incidents overlapping these categories, the data confirms a critical structural shift: the modern supply chain threat is essentially an identity compromise disguised as a software security failure.
• TeamPCP has emerged as the dominant criminal supply chain operator, linked to approximately 34.1% of all incidents where a threat actor was identified (45 of 132). This industrialized presence significantly leads other active clusters, including UNC1069, Lazarus Group, and ShinyHunters, which each account for 3.8% of the attributed population.
• Artificial intelligence has matured into a dual-threat vector, featuring in approximately 18% of all analyzed incidents and reaching a monthly peak of 28% in February 2026. This activity encompasses the exfiltration of LLM administrative credentials, the poisoning of model-serving frameworks, the introduction of malicious "skills" into emerging AI marketplaces, and the deployment of industrialized, AI-automated attack payloads designed for rapid scale.
• Upstream compromise regularly bypasses perimeter defenses to infiltrate live production environments: Analysis of backup telemetry confirms that high-leverage campaigns including Atomic Stealer (AMOS), BeaverTail, and WAVESHAPER.V2 remained active and undetected within customer environments across the Retail, Government, Technology, Telecommunications, and Healthcare sectors. These threats successfully evaded email security, endpoint protection, and firewall layers, only surfacing upon reaching the data layer, as further detailed in Section 3.4.
• The operational and fiscal consequences of supply chain infiltration range from industrialized technical contagion to multimillion-dollar exfiltration events: High-leverage exposures identified in this window include the Axios maintainer account takeover—threatening a codebase with 100 million weekly downloads—and a malicious Hugging Face repository that reached 244,000 downloads before intervention. Quantified financial impact during this period exceeds $16.8 million across four verified incidents, featuring an $8.5 million crypto-wallet heist linked to the Shai-Hulud worm (Trust Wallet), a $5.1 million wire-fraud operation against Trinity Software, and a $3.1 million frontend drain at Polymarket.

1.1 Monthly trend: How has attack activity moved through 2026?

New incident volume rose steadily from January through a plateau in April–May 2026, then eased over the following two months: January (13 incidents) → February (22) → March (27) → April (33) → May (53 — the peak of the window) →June (43) → July, through the 28th (37).

Identity and AI-related attack techniques show no corresponding decline. The modest pullback in June–July should not be read as evidence that underlying risk is receding.

Ecosystem Analysis: Software Registries & Version Control Platforms

2. Ecosystem Analysis: Software Registries & Version Control Platforms

2.1 Registry/ecosystem distribution

Across the 311 incidents where a package ecosystem could be identified, the distribution is heavily concentrated in JavaScript/Node's package registry as shown in Figure 2.
 

The dominance of the npm registry (50.2%) represents a structural vulnerability, rather than an incidental trend. This ecosystem maintains the largest active developer population while often featuring historically permissive controls on lifecycle scripts—a mechanism leveraged in several 2026 incidents, such as the Miasma campaign's use of preinstall hooks to exfiltrate SSH keys and cloud tokens across 309 repositories. Furthermore, the registry's maintainer-account model remains highly susceptible to phishing, as evidenced by the Axios maintainer takeover, which stands as the most critical individual breach of this window. Conversely, the 7.1% share for PyPI is primarily driven by high-impact campaigns like those targeting LiteLLM and the Telnyx SDK. While lower in overall incident volume, PyPI attacks demonstrate elevated individual severity; for instance, the LiteLLM breach resulted in 33,000 exposed deployments and a 4TB data exfiltration event impacting Mercor, a platform for AI recruiting and training.

The "Other" category represents the second-largest attack surface (29.3%) and encompasses a fragmented landscape of emerging distribution channels. This includes IDE extension marketplaces (VS Code, JetBrains), AI agent marketplaces (Hugging Face, ClawHub), and browser extension stores. These platforms are increasingly targeted because they lack the mature scanning, provenance, and registry-level integrity controls characteristic of traditional package managers.

2.2 Version control platform exposure

CI/CD pipelines and automated version control workflows represent a high-leverage vector for industrialized exploitation, featuring in approximately 12.6% of all analyzed incidents (58 of 461). This data confirms that infrastructure-as-code compromise has matured into a foundational methodology, rivaling the prevalence of major malware families. The Megalodon campaign serves as a primary case study in the speed of this surface, facilitating the injection of over 5,700 malicious commits into thousands of GitHub repositories within a single six-hour window to exfiltrate cloud credentials, SSH keys, and CI/CD secrets.

2.3 What the ecosystem data implies

Registry-level security posture is inversely correlated with adversary attention, creating significant exposure for ecosystems beyond npm and PyPI. Adversaries are strategically targeting lower-maturity distribution channels — particularly AI agent and skill marketplaces — specifically because these platforms lack the mature scanning, provenance, and registry-level integrity controls characteristic of traditional package managers, as detailed in Section 6. Simultaneously, the CI/CD and GitHub Actions automation layer has matured into a foundational force multiplier: a single misconfigured workflow or stolen Actions token can facilitate the compromise of thousands of repositories within a single window, regardless of an individual package's download footprint.

3. High-Profile Threat Actor Profiles & Campaigns

3.1 Threat actor prevalence

Of the 132 incidents with a specific named threat actor, activity is led by one group:

Adversaries linked to the DPRK continue to function as the most persistent state-aligned threat cluster: Groups including UNC1069, Lazarus Group, Void Dokkaebi, and Sapphire Sleet represent a major portion of attributed state activity. These actors have industrialized supply chain tactics—leveraging maintainer-account hijacking, poisoning registry packages, and social engineering for credential exfiltration—as a foundational methodology for pursuing both intelligence objectives and financial monetization.

3.2 Threat actor profiles: attack type, motivation, and malware

TeamPCP (financially motivated) — the industrialized supply chain operator. This criminal cluster represents the most prolific threat actor in the current landscape, maintaining an expansive portfolio that spans PyPI (LiteLLM), npm, and even core security infrastructure. The group twice compromised Checkmarx’s KICS scanner using trojanized Docker images and malicious VS Code extensions, while its campaign against the Trivy scanner evolved into a Lapsus$-affiliated extortion wave affecting over 1,000 SaaS environments. TeamPCP further demonstrated technical sophistication by poisoning the Telnyx Python SDK, using WAV audio steganography to deploy a harvester specifically targeting SSH keys, Kubernetes/cloud credentials, and crypto-wallets. Its ransomware affiliate, Vect, contains a structural defect that makes it function as a wiper for larger files—a critical technical finding that reinforces the cyber resilience mandate detailed in Section 7.

UNC1069 (DPRK-linked, financially motivated) — the Axios maintainer-hijack cluster. This adversary successfully infiltrated the Axios npm maintainer account to facilitate the distribution of the WAVESHAPER.V2 backdoor through a deceptive dependency. The campaign impacted 19 organizations and represents the most significant incident identified in this report, given that the compromised codebase maintains a footprint of over 100 million weekly downloads. Beyond this specific breach, UNC1069 is orchestrating an expansive social engineering offensive aimed at maintainers of high-leverage Node.js libraries, including Lodash, Fastify, and Pino.

Lazarus Group (DPRK-linked, financially motivated) — npm typosquatting for wallet theft. This state-aligned cluster distributed deceptive packages mimicking Rollup polyfills to deploy multi-stage payloads. The campaign integrated remote-access capabilities with specialized cryptocurrency wallet-theft modules, exemplifying the group's use of the software registry as a direct conduit for financial exfiltration.

ShinyHunters (financially motivated) — SaaS supply chain and OAuth abuse. Compromises customer SaaS environments through trusted third-party integrations and stolen OAuth tokens, bypassing credential theft entirely by abusing already-authorized application trust relationships.

JINX-0164 (DPRK-linked, financially motivated) — industrialized credential harvesting from developer endpoints. This adversary utilizes LinkedIn for social engineering campaigns aimed at cryptocurrency developers to facilitate the delivery of AUDIOFIX and MINIRAT malware. The group’s operations prioritize the exfiltration of crypto-wallet credentials, cloud secrets, and GitHub tokens, while increasingly leveraging CI/CD hijacking as a high-leverage secondary attack vector to extend its reach into production environments.

Sapphire Sleet (DPRK-linked, financially motivated) — the Mastra AI supply chain attack. This adversary infiltrated the mastra and @mastra npm scopes, poisoning over 140 packages via a single maintainer account takeover. The campaign highlights a strategic shift: AI agent framework packages have matured into a first-class target, possessing the same high-leverage risk profile as traditional core libraries.

ScarCruft (DPRK-aligned, espionage) — multiplatform compromise via trojanized consumer software. Deployed the BirdCall backdoor across both Windows and Android via a trojanized gaming platform, blending consumer software supply chain compromise with traditional espionage tradecraft.

Void Dokkaebi / Famous Chollima (DPRK, financially motivated) — fake-job-offer self-propagation. Converted the well-known "fake recruiter" social engineering lure into a self-propagating campaign infecting hundreds of public repositories via malicious VS Code task configurations and deploying the DEV#POPPER RAT over blockchain-based C2 infrastructure.

Lotus Blossom (espionage-motivated) — a six-month, undetected update-channel compromise. Compromised the popular Notepad++ text editor's hosting infrastructure and update system for six months (June–December 2025), installing the Chrysalis backdoor via DLL sideloading for persistence and command-and-control, it is one of the longest-duration, most stealthy compromises in this report's window.

OceanLotus (espionage-motivated) — multi-vector registry and corporate infrastructure compromise. This adversary utilized malicious PyPI wheel packages to facilitate the delivery of ZiChatBot malware, strategically leveraging Zulip’s REST APIs as stealthy command-and-control infrastructure. Beyond registry-based operations, the group maintained a highly persistent, nearly two-year presence within a Vietnamese transportation and construction firm, demonstrating the significant long-dwell capabilities of state-aligned espionage actors in the modern landscape.

Funnull (financially motivated, infrastructure-scale) — CDN and CMS supply chain poisoning. Runs the RingH23 campaign, compromising GoEdge CDN nodes to poison the MacCMS content-management supply chain at a scale estimated to affect millions of users daily — illustrating how compromising shared infrastructure (a CDN) rather than a single package can multiply blast radius by orders of magnitude.

Lapsus$ (financially/notoriety motivated) — high-volume data exfiltration. Linked to large-scale data exfiltration via the LiteLLM supply-chain compromise and separately claimed responsibility for dumping source code and secrets from additional victims.

3.3 Malware families in active use

Across the 163 incidents where a specific malware lineage was identified, the distribution highlights a landscape dominated by self-propagating technical contagion: Shai-Hulud, a virulent npm-based worm, accounts for approximately 12.9% of the attributed population. The public leakage of its source code has birthed a sprawling imitator ecosystem, including Mini Shai-Hulud (5.6%) and Miasma (2.5%), a loader utilized for botnet expansion via poisoned package namespaces. The industrialized proliferation of worms is further evidenced by CanisterWorm and GlassWorm, which each represent 3.7% of the dataset. Notable recurring threats include Hades, a Shai-Hulud derivative leveraging Python wheel `.pth` files for persistence; Qilin ransomware; and the Atomic MacOS Stealer (AMOS), which has migrated into emerging AI agent marketplaces like ClawHub. High-leverage toolsets also feature prominently, such as STX RAT, distributed via trojanized hardware installers; Lotus Blossom’s Chrysalis backdoor; Funnull’s RingH23 infrastructure-poisoning suite; and the espionage-aligned PRISMEX and PhantomRaven clusters, which continue to target critical sectors including DeFi and AI development.

3.4 Beyond the Front Line: What Backup Telemetry Shows

An evaluation of backup telemetry within customer environments during this reporting period identifies a critical subset of threats that consistently circumvented perimeter security: Atomic Stealer (AMOS), BeaverTail, and WAVESHAPER.V2.Telemetry confirms their successful infiltration into live production environments, where they remained undetected by email, endpoint, and firewall layers until surfacing at the data layer.

Atomic Stealer (AMOS) represents the most expansive threat identified in this dataset, appearing in backup telemetry between April and July 2026. Primarily distributed through trojanized "skills" in the OpenClaw/ClawHub AI agent marketplace, the malware exfiltrates browser data, cryptocurrency wallets, and sensitive files. Its footprint spans the Retail, Government, and Technology sectors, reflecting the most significant industrial reach of the families analyzed.

BeaverTail, linked to the PurpleBravo cluster, utilizes industrialized "fake recruiter" social engineering to facilitate direct installation on developer endpoints. Operating in tandem with the PyLangGhost toolkit to harvest credentials and digital assets, this campaign is linked to over 3,000 compromised IP addresses. Telemetry confirmed active BeaverTail presence within the Technology and Telecommunications sectors between April and June 2026.

WAVESHAPER.V2, the backdoor deployed via the Axios maintainer-account hijacking, remains a persistent threat within the landscape. Despite the high-profile nature of the original breach, telemetry confirmed the backdoor active inside a Healthcare environment as recently as July 2026. This data provides empirical evidence that high-leverage upstream compromises often maintain long-dwell functionality well beyond their public disclosure dates.

The presence of these campaigns within production infrastructure confirms that registry-based threats successfully bypass front-line defenses. Analysis across the Retail, Government, Technology, Telecommunications, and Healthcare sectors illustrates that supply chain compromise is a foundational operational reality. These cases emphasize that industrialized threat actors are achieving significant dwell time in the data layer long after initial detection at the source.

4. Sophisticated Attack Vectors & Methodology

4.1 Attack behaviors

Analyzing attack behaviors across 335 incidents where at least one behavior could be identified:

The exfiltration of credentials and sensitive secrets has emerged as the primary objective for adversaries, featuring in roughly 52.5% of incidents with a confirmed attack behavior. This data reinforces a critical strategic prioritization: threat actors are first establishing persistent administrative footholds before pursuing direct monetization. The prevalence of backdoor and RAT deployment (34.6%)—including specific implants like WAVESHAPER.V2, AUDIOFIX, MINIRAT, and BirdCall—confirms that achieving long-term persistence is a core adversary requirement. Furthermore, self-propagating worm activity (24.2%) remains a deliberate design goal rather than an incidental outcome; clusters such as Shai-Hulud, Mini Shai-Hulud, CanisterWorm, and GlassWorm are engineered to convert each compromised endpoint or repository into a secondary infection vector.

4.2 Identity-specific entry vectors

A granular evaluation of entry mechanisms reveals that approximately 11.1% of all incidents (51 of 461) were facilitated by a specific set of identity-centric vectors. These high-leverage entry points include stolen npm or GitHub tokens (5.0%), OAuth and session abuse (3.7%), and the phishing of maintainer accounts (3.5%). Despite the increasing prevalence of multi-factor authentication, MFA bypass techniques accounted for roughly 0.9% of analyzed cases, while compromised SSO integrations remained undetected within this specific reporting window. These categories frequently overlap, highlighting the multifaceted nature of modern identity exploitation.

4.3 Other methodology signals

Adversaries are increasingly pivoting away from elementary techniques: typosquatting was identified in only 5.4% of cases (25 incidents), while the use of malicious lifecycle scripts (3.3%) and dependency confusion (1.1%) show even lower prevalence. This trend confirms that while modern registries effectively mitigate naive, naming-based exploitation, the strategic focus has shifted toward higher-leverage identity abuse and CI/CD compromise as the primary drivers of successful supply chain infiltration.

5. Industrial and Regional Impact Case Studies

Axios (global developer tooling) — the most significant individual breach identified. The infiltration of the Axios npm maintainer account by UNC1069 facilitated the distribution of the WAVESHAPER.V2 backdoor through a deceptive dependency. While confirmed impact was limited to 19 organizations, the codebase’s footprint of 100 million weekly downloads makes this the report's primary case study in asymmetric blast-radius risk: a localized compromise masking vast, latent exposure across the global developer ecosystem.

Trivy and Checkmarx (global security tooling) — adversaries targeting the core defensive arsenal. This period saw a concentrated offensive against security-centric infrastructure, with TeamPCP and Lapsus$-affiliated actors executing distinct operations against Aqua Security's Trivy scanner and Checkmarx's KICS scanner. The Trivy compromise matured into a significant extortion wave impacting over 1,000 SaaS environments, while KICS was breached twice via trojanized Docker images and malicious VS Code extensions. These incidents confirm a strategic shift: rather than incidental targeting, adversaries are systematically poisoning the high-leverage tools that enterprise defenders trust most.

Megalodon (GitHub, global) — 5,561 repositories compromised in six hours. This industrialized, high-velocity campaign facilitated the injection of over 5,700 malicious commits into 5,561 GitHub repositories within a single six-hour window. The operation prioritized the exfiltration of cloud credentials, SSH keys, and CI/CD secrets, serving as a primary case study in automated mass-compromise where the speed of technical contagion outpaces traditional human detection capabilities.

Polymarket (crypto/fintech, global) — ~$3M frontend supply chain drain. A compromised third-party vendor injected malicious JavaScript into Polymarket's frontend via a poisoned npm package and stolen CI/CD tokens, draining an estimated $2.9M–$3.1M from user wallets in late June 2026 — a clear, fully quantified case of a downstream *financial* consequence from an upstream *software* compromise.

Trust Wallet (cryptocurrency, global) — $8.5M Chrome-extension heist via Shai-Hulud. A second wave of the Shai-Hulud npm supply chain attack likely compromised Trust Wallet's Chrome browser extension, draining approximately $8.5 million from over 2,500 crypto wallets — one of the clearest examples in this report of a widely propagating npm worm converting directly into large-scale consumer financial loss.

ScarCruft (DPRK-aligned, espionage) — multiplatform compromise via trojanized consumer software. This adversary executed a sophisticated supply chain operation by infiltrating a consumer gaming platform to deliver the BirdCall backdoor across Windows and Android ecosystems. The campaign, which specifically targeted the Yanbian region, serves as a critical case study in how state-aligned actors leverage consumer software distribution channels to pursue narrowly defined espionage objectives rather than broad-based financial exfiltration.

Notepad++ (global developer tooling) — a six-month, undetected update-channel compromise. Lotus Blossom's compromise of Notepad++'s hosting infrastructure and update mechanism ran undetected for roughly six months, delivering the Chrysalis backdoor.

6. The Role of AI in Supply Chain Attacks

Artificial intelligence has matured into a dual-threat vector, featuring in approximately 18% of all analyzed incidents (85 of 461) and reaching a monthly peak of 28% in February 2026. This data confirms that AI involvement has transitioned from a technical novelty into a persistent, structural feature of the modern supply chain threat landscape.

AI shows up across four distinct, escalating categories:

1. AI infrastructure has emerged as a primary target: The compromise of LiteLLM, an LLM gateway, was linked to 33,000 exposed deployments and a 4TB data exfiltration event in a single window. Similarly, the Mastra AI agent framework saw over 140 npm packages poisoned via a single maintainer-account takeover, an operation attributed to Sapphire Sleet.

2. Administrative credentials for AI infrastructure have matured into a primary theft objective: A cluster of fifteen fraudulent JetBrains IDE extensions achieved nearly 70,000 installations, specifically engineered to exfiltrate AI-related API credentials. 

3. AI marketplaces have matured into a novel, inadequately protected distribution vector: Adversaries successfully deployed over 575 compromised "skills" across Hugging Face and ClawHub, facilitating the delivery of trojanized payloads, unauthorized cryptominers, and the Atomic MacOS Stealer (AMOS). A distinct operation targeted the Moltbot/OpenClaw ecosystem, infiltrating nearly 400 fraudulent crypto-trading extensions into the assistant environment. Furthermore, a single deceptive AI agent skill bypassed initial security verification, reaching a footprint of 26,000 users primarily through social engineering on Instagram.

Final Strategic Evaluation: Artificial intelligence has evolved into a high-leverage dual-threat surface. It functions as both a primary objective for credential exfiltration and infrastructure access and as an inadequately protected distribution channel that adversaries are exploiting at industrial scale. AI has matured into an offensive force multiplier, accelerating the development of automated threat delivery. Organizations that have integrated AI frameworks and marketplaces without extending foundational supply-chain security and identity controls remain critically exposed within the modern landscape.

7. Why Cyber Resilience Is Important

Four findings from this report point to the same conclusion: prevention alone is not a viable strategy for software supply chain risk, and organizations must be able to detect, contain, and recover fast when — not if — a compromise occurs.

First, response windows have collapsed to hours, and detection can lag by months -  Megalodon (GitHub, global) — 5,561 repositories compromised in six hours. This industrialized, high-velocity campaign facilitated the injection of over 5,700 malicious commits into thousands of repositories within a single six-hour window. Separately, industry data indicates that the transition from initial vulnerability exploitation to active ransomware deployment can occur in as little as 22 seconds — effectively eliminating the window for manual, human-speed intervention. These findings confirm that resilience planning must prioritize automated detection and containment, as the velocity of technical contagion now far outpaces traditional human analysis.

Second, paying does not guarantee recovery — TeamPCP’s ransomware affiliate, Vect, contains a structural defect that makes it function as a wiper for larger files. This technical failure ensures that victims pursuing financial remediation in good faith may still suffer irreversible data loss. This behavior is a documented characteristic of a family actively targeting 2026 entities, reinforcing that the threat of permanent destruction is a core operational reality rather than a theoretical concern.

Third, the blast radius of individual upstream compromises is measured in the hundreds of thousands to millions –  A single WordPress plugin compromise (Smart Slider 3 Pro) hit 900,000+ websites. A single CDN/CMS poisoning campaign (Funnull's RingH23) is estimated to affect millions of users daily, on an ongoing basis. These are not isolated, contained incidents — they are cascading failures that propagate through dependency graphs and shared infrastructure far beyond the originally compromised organization's own network boundary, meaning an organization's exposure is only partly within its own control.

Fourth, the empirical data confirms that registry-based threats consistently circumvent perimeter security: As detailed in Section 3.4, three high-leverage malware families—Atomic Stealer (AMOS), BeaverTail, and WAVESHAPER.V2—successfully infiltrated live production environments across five distinct industry sectors during this reporting window. These campaigns successfully evaded email security, endpoint protection, and firewall layers, only surfacing upon reaching the data layer. This provides empirical evidence that front-line prevention alone is insufficient, reinforcing the absolute mandate for the cyber resilience capabilities described throughout this report.

Cyber resilience has matured into the critical determinant of whether a supply chain compromise remains a contained event or escalates into a catastrophic failure. This capability—defined by the maintenance of immutable, isolated backups, near real-time detection of anomalous identity and CI/CD behavior, and the execution of a validated recovery process—is essential in a landscape where approximately 37% of incidents originate from identity and credential exploitation. Because the dataset confirms that adversaries utilize both high-velocity technical contagion and long-dwell "slow-burn" tactics, strategic planning must assume the eventual breach of perimeter and credential layers. Consequently, enterprise defense must prioritize minimizing time-to-detect and time-to-recover as the primary metrics for survival, rather than relying on prevention alone.

8. Recommendations

Identity and access:

1. Treat every maintainer account, CI/CD service identity, administrative account (including SaaS Global Admin roles), and OAuth/SaaS integration grant as a Tier-0 credential requiring phishing-resistant MFA (hardware security keys or platform authenticators, not SMS/TOTP) — the Axios, and dozens of other 2026 incidents in this report succeeded specifically by defeating weaker MFA or bypassing it via social engineering.

2. Adopt least-privilege, time-bound, and auditable tokens for CI/CD pipelines and package-publishing rights; rotate publish credentials on a defined cadence and require step-up verification for any release that changes install scripts, dependencies, or binaries.

3. Regularly audit third-party OAuth grants and SaaS integrations, and apply the same rigor to platform administrative roles (e.g., Microsoft 365 Global Admin, Intune) that govern high-impact, irreversible actions like remote wipe.

4. Extend identity monitoring to non-human identities: bot commit accounts, GitHub Actions service tokens, and package-registry publish tokens should be monitored for anomalous behavior with the same rigor as human user accounts, given how consistently they were abused in this window's largest campaigns.

Cyber resilience and recovery:

5. Organizations must architect detection and segmentation frameworks capable of disrupting lateral movement, treating both industrialized, high-velocity contagion (hours, as evidenced by Megalodon) and sophisticated, long-dwell infiltration (months, as seen with OceanLotus) as foundational threat models. This necessity is underscored by the empirical data in Section 3.4, which confirms that Atomic Stealer (AMOS), BeaverTail, and WAVESHAPER.V2 successfully bypassed email security, endpoint protection, and firewall layers to reach the data layer of live production environments. Establishing robust recovery capabilities is critical for neutralizing these upstream compromises that successfully evade perimeter defenses for extended periods.

6. Maintain immutable, air-gapped, and regularly tested backups isolated from production identity systems, specifically to defend against wiper-class ransomware (as demonstrated by Vect) where paying an extortion demand — or simply trusting the platform's own recovery tools — does not guarantee data recovery.

7. Extend software composition analysis and behavioral scanning beyond traditional package registries (npm, PyPI) to lower-maturity distribution channels now actively being targeted: IDE/editor extension marketplaces, AI agent/skill marketplaces, CDN/CMS supply chains, and standalone application update mechanisms — and prioritize security tooling itself as a high-value target requiring the same scrutiny as any other critical dependency.

8. Build and rehearse an incident response and recovery plan specific to upstream/dependency compromise and mass-identity-compromise scenarios — including a defined process for rapid dependency pinning/rollback, credential rotation across CI/CD and cloud environments, and clean, verified data restoration — and test it before it's needed, not during.

AI-specific governance:

9. Apply the same provenance, scanning, and least-privilege controls to AI coding assistants, agent frameworks, and MCP/skill marketplaces that are already applied to traditional package dependencies; treat AI agent tool-use permissions as a privileged identity requiring the same monitoring as a human or service accounts.

10. Establish guardrails against AI-hallucination-based and AI-marketplace-based attacks by validating AI-suggested package or dependency names, and any AI agent "skill" installs, against verified registries and provenance checks before installation, rather than trusting assistant or marketplace output directly.