supply chain attack - Mochiai.blog

China‑linked PlushDaemon hijacks DNS via EdgeStepper to weaponize software updates

By Shweta Sharma
November 20, 2025

Hijacked update to backdoor deployment With the network device serving as a stealthy redirect, PlushDaemon then exploits the hijacked update channel to gain access…

Self-propagating worm found in marketplaces for Visual Studio Code extensions

By Howard Solomon
October 21, 2025

CISOs must include developers in discussions about securing development tools, he advises. Limiting permitted tools is often counterproductive, as developers will identify workarounds to…