{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "crypto",
    "label": "Crypto",
    "isStack": false,
    "url": "https://pwn.watch/t/crypto",
    "feed": "https://pwn.watch/t/crypto/feed.xml"
  },
  "counts": {
    "incidents": 9,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 9
  },
  "incidents": [
    {
      "slug": "glassworm-vscode-openvsx-worm-october-2025",
      "title": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025",
      "json": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "VS Code extensions on OpenVSX and the VS Code Marketplace",
      "tags": [
        "devtools",
        "glassworm",
        "vscode",
        "openvsx",
        "supply-chain",
        "worm",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [
        "e.g. CodeJoy 1.8.3/1.8.4, cline-ai-agent 3.1.3 (Microsoft marketplace) and several OpenVSX extensions (see Koi list)"
      ],
      "fixedVersions": [
        "Malicious releases removed from the marketplaces"
      ],
      "startedAt": "2025-10-17",
      "closedAt": "2025-10-31",
      "updatedAt": "2025-10-31",
      "summary": "Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.",
      "xPost": null
    },
    {
      "slug": "chalk-debug-npm-hijack-september-2025",
      "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025",
      "json": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 more",
      "tags": [
        "npm",
        "node",
        "chalk",
        "phishing",
        "supply-chain",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [
        "chalk 5.6.1",
        "debug 4.4.2",
        "ansi-styles 6.2.2",
        "strip-ansi 7.1.1",
        "supports-color 10.2.1",
        "ansi-regex 6.2.1",
        "wrap-ansi 9.0.1",
        "slice-ansi 7.1.1",
        "has-ansi 6.0.1",
        "chalk-template 1.1.1",
        "supports-hyperlinks 4.1.1",
        "others: see debug-js/debug#1005"
      ],
      "fixedVersions": [
        "chalk 5.6.2",
        "ansi-styles 6.2.3",
        "strip-ansi 7.1.2",
        "supports-color 10.2.2",
        "ansi-regex 6.2.2",
        "wrap-ansi 9.0.2",
        "slice-ansi 7.1.2",
        "has-ansi 6.0.2",
        "chalk-template 1.1.2",
        "supports-hyperlinks 4.1.2",
        "debug and others: republished by the maintainer on 2025-09-13"
      ],
      "startedAt": "2025-09-08",
      "closedAt": "2025-09-13",
      "updatedAt": "2025-09-15",
      "summary": "Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.",
      "xPost": null
    },
    {
      "slug": "coinbase-bribed-support-agents-breach-may-2025",
      "title": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025",
      "json": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Coinbase customer support systems",
      "tags": [
        "coinbase",
        "crypto",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-05-11",
      "closedAt": "2025-05-30",
      "updatedAt": "2025-05-30",
      "summary": "Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.",
      "xPost": null
    },
    {
      "slug": "bybit-1-5b-hack-safe-wallet-february-2025",
      "title": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025",
      "json": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "Bybit cold wallet / Safe{Wallet} web UI",
      "tags": [
        "bybit",
        "safe-wallet",
        "crypto",
        "north-korea",
        "lazarus",
        "aws",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-02-21",
      "closedAt": "2025-03-06",
      "updatedAt": "2025-03-06",
      "summary": "North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.",
      "xPost": null
    },
    {
      "slug": "solana-web3-js-npm-compromise-cve-2024-54134",
      "title": "@solana/web3.js npm package backdoored to steal private keys",
      "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134",
      "json": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "@solana/web3.js (npm)",
      "tags": [
        "node",
        "npm",
        "solana",
        "crypto",
        "supply-chain"
      ],
      "cveIds": [
        "CVE-2024-54134"
      ],
      "affectedVersions": [
        "1.95.6",
        "1.95.7"
      ],
      "fixedVersions": [
        "1.95.8"
      ],
      "startedAt": "2024-12-03",
      "closedAt": "2024-12-04",
      "updatedAt": "2024-12-04",
      "summary": "A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.",
      "xPost": null
    },
    {
      "slug": "lottiefiles-lottie-player-npm-compromise",
      "title": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer",
      "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise",
      "json": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "@lottiefiles/lottie-player (npm)",
      "tags": [
        "node",
        "npm",
        "lottiefiles",
        "crypto",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "2.0.5",
        "2.0.6",
        "2.0.7"
      ],
      "fixedVersions": [
        "2.0.8"
      ],
      "startedAt": "2024-10-30",
      "closedAt": "2024-10-31",
      "updatedAt": "2024-10-31",
      "summary": "A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.",
      "xPost": null
    },
    {
      "slug": "ledger-connect-kit-npm-supply-chain-2023",
      "title": "Ledger Connect Kit npm package hijacked to drain crypto wallets",
      "url": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023",
      "json": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "@ledgerhq/connect-kit (npm)",
      "tags": [
        "npm",
        "node",
        "ledger",
        "supply-chain",
        "crypto",
        "wallet-drainer",
        "phishing"
      ],
      "cveIds": [],
      "affectedVersions": [
        "@ledgerhq/connect-kit 1.1.5, 1.1.6, 1.1.7"
      ],
      "fixedVersions": [
        "1.1.8"
      ],
      "startedAt": "2023-12-14",
      "closedAt": "2023-12-14",
      "updatedAt": "2023-12-14",
      "summary": "Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.",
      "xPost": null
    },
    {
      "slug": "retool-sms-phishing-google-authenticator-sync-2023",
      "title": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023",
      "json": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Retool (cloud)",
      "tags": [
        "retool",
        "phishing",
        "social-engineering",
        "google-authenticator",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-08-27",
      "closedAt": "2023-09-13",
      "updatedAt": "2023-09-13",
      "summary": "An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.",
      "xPost": null
    },
    {
      "slug": "jumpcloud-nation-state-breach-2023",
      "title": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023",
      "json": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "JumpCloud (directory / device management SaaS)",
      "tags": [
        "jumpcloud",
        "north-korea",
        "phishing",
        "supply-chain",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-06-27",
      "closedAt": "2023-07-20",
      "updatedAt": "2023-07-20",
      "summary": "A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "glassworm-vscode-openvsx-worm-october-2025",
      "incidentTitle": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-20",
      "title": "Wider coverage; Microsoft marketplace extension also affected",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025"
    },
    {
      "incident": "glassworm-vscode-openvsx-worm-october-2025",
      "incidentTitle": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-17",
      "title": "Koi Security discloses GlassWorm on OpenVSX",
      "body": null,
      "sourceUrl": "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-15",
      "title": "Initial CVEs posted",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-13",
      "title": "All remaining affected packages republished by the maintainer",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "Malicious versions start appearing on npm (13:16 UTC)",
      "body": null,
      "sourceUrl": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "Sindre Sorhus publishes clean chalk-family versions over the compromised ones",
      "body": null,
      "sourceUrl": "https://github.com/chalk/chalk/issues/656",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST)",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05-15",
      "title": "Coinbase discloses the breach in an SEC filing and refuses the $20M ransom",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05-11",
      "title": "Coinbase receives the extortion demand and discovers the breach",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05",
      "title": "Breach notice puts affected customers at 69,461",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-03-06",
      "title": "Safe{Wallet} confirms a developer machine compromise by TraderTraitor",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-02-26",
      "title": "FBI attributes the theft to North Korea ('TraderTraitor')",
      "body": null,
      "sourceUrl": "https://www.ic3.gov/psa/2025/psa250226",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-02-21",
      "title": "About $1.5B in ETH drained from a Bybit cold wallet",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-12-26",
      "title": "Unauthorized access begins (per breach notification)",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "solana-web3-js-npm-compromise-cve-2024-54134",
      "incidentTitle": "@solana/web3.js npm package backdoored to steal private keys",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-04",
      "title": "GitHub advisory GHSA-jcxm-7wvp-g6p5 published; upgrade to 1.95.8",
      "body": null,
      "sourceUrl": "https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5",
      "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134"
    },
    {
      "incident": "solana-web3-js-npm-compromise-cve-2024-54134",
      "incidentTitle": "@solana/web3.js npm package backdoored to steal private keys",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-03",
      "title": "Malicious 1.95.6 and 1.95.7 published to npm (15:20-20:25 UTC), then unpublished",
      "body": null,
      "sourceUrl": "https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5",
      "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134"
    },
    {
      "incident": "lottiefiles-lottie-player-npm-compromise",
      "incidentTitle": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-30",
      "title": "Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup",
      "body": null,
      "sourceUrl": "https://github.com/LottieFiles/lottie-player/issues/254",
      "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise"
    },
    {
      "incident": "lottiefiles-lottie-player-npm-compromise",
      "incidentTitle": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-30",
      "title": "LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8",
      "body": null,
      "sourceUrl": "https://github.com/LottieFiles/lottie-player/issues/254",
      "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise"
    },
    {
      "incident": "ledger-connect-kit-npm-supply-chain-2023",
      "incidentTitle": "Ledger Connect Kit npm package hijacked to drain crypto wallets",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-14",
      "title": "Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed",
      "body": null,
      "sourceUrl": "https://www.ledger.com/blog/security-incident-report",
      "url": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023"
    },
    {
      "incident": "retool-sms-phishing-google-authenticator-sync-2023",
      "incidentTitle": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-13",
      "title": "Retool publishes its write-up",
      "body": null,
      "sourceUrl": "https://retool.com/blog/mfa-isnt-mfa",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023"
    },
    {
      "incident": "retool-sms-phishing-google-authenticator-sync-2023",
      "incidentTitle": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-08-27",
      "title": "SMS phishing and voice call lead to compromise of a Retool employee account and 27 cloud customers",
      "body": null,
      "sourceUrl": "https://retool.com/blog/mfa-isnt-mfa",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023"
    },
    {
      "incident": "jumpcloud-nation-state-breach-2023",
      "incidentTitle": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-07-20",
      "title": "SentinelOne links the intrusion infrastructure to North Korean APT activity",
      "body": null,
      "sourceUrl": "https://www.sentinelone.com/labs/jumpcloud-intrusion-attacker-infrastructure-links-compromise-to-north-korean-apt-activity/",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023"
    },
    {
      "incident": "jumpcloud-nation-state-breach-2023",
      "incidentTitle": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-07-12",
      "title": "JumpCloud publishes incident details and indicators",
      "body": null,
      "sourceUrl": "https://jumpcloud.com/blog/security-update-incident-details",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023"
    },
    {
      "incident": "jumpcloud-nation-state-breach-2023",
      "incidentTitle": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-07-05",
      "title": "JumpCloud rotates all customer API keys",
      "body": null,
      "sourceUrl": "https://jumpcloud.com/blog/security-update-incident-details",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023"
    },
    {
      "incident": "jumpcloud-nation-state-breach-2023",
      "incidentTitle": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-06-27",
      "title": "JumpCloud finds anomalous activity on an internal orchestration system",
      "body": null,
      "sourceUrl": "https://jumpcloud.com/blog/security-update-incident-details",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023"
    }
  ]
}