CloudSEK

CloudSEK is a contextual AI company that predicts Cyber Threats.

Combining the power of Cyber,Brand & Attack Surface monitoring to give context to Digital Risk

[CloudSEK @cloudsek]

Online gambling didn’t end when Cambodia, Myanmar and the Philippines cracked down. It moved to Indonesia. A new CloudSEK report follows the money: https://t.co/iVglnehUfD

[CloudSEK @cloudsek]

Fake AI SDKs. Hidden Windows RAT. Seven malicious npm packages.

CloudSEK uncovered NEBULA, a supply-chain campaign deploying malware capable of stealthy remote access and surveillance.

Two packages were still downloadable as of Oct 8.

Read: https://t.co/8iqUDJLbmD

[CloudSEK @cloudsek]

One exposed server gave up an entire ransomware operation.
A Gentlemen affiliate breached 2 dozen+ orgs across 6 countries via stolen CI/CD secrets, then ran attacks through an AI assistant over MCP, a technique with no prior public reporting.

https://t.co/KYDy450fUM

[CloudSEK @cloudsek]

What if attackers could rent their way into a victim’s infrastructure?

CloudSEK uncovered VHX Harvester targeting vast ai — scanning 13,368 endpoints, deploying 25 bridge agents and reaching a root shell.

Read Part 2: https://t.co/IVlIsnzF6o

[CloudSEK @cloudsek]

85 malicious npm packages. Just over 3 minutes to publish them.

CloudSEK found a typosquatting campaign built to surface in search and autocomplete, then connect systems to a remote command channel.

Read Part 1: https://t.co/UPUpl92xFy

[CloudSEK @cloudsek]

A malicious npm package stayed undetected for 14 months.

CloudSEK’s MALFEX investigation reveals a supply-chain campaign using RATs, credential stealers and Solana-based C2 — with parts remaining reachable even after takedowns.
https://t.co/P8Bdrecv0i

[CloudSEK @cloudsek]

A legitimate npm package was compromised — and the malicious release still carried valid provenance. CloudSEK uncovered GHAPPIER, spanning 65 repositories, 73 infected files and 22 accounts.

Full research: https://t.co/p6lHZGlFIq

[CloudSEK @cloudsek]

A routine npm install can cross from WSL into Windows.

CloudSEK’s BRIDGEHEAD investigation found 40 typosquatted npm packages delivering a payload targeting crypto wallets, browser credentials and Telegram sessions.

Read: https://t.co/hxWvj9hWRU

[CloudSEK @cloudsek]

CloudSEK uncovered an exposed attacker workspace with 142K+ files, revealing AI agents being used to automate offensive hacking. Evidence includes 8,996 compromised WordPress sites, stolen credentials and crypto wallet data.

https://t.co/wosPEOGzcJ

[CloudSEK @cloudsek]

2,500+ organisations potentially exposed in a major AI supply-chain breach involving LiteLLM. Cloud credentials, source-code access and AI/API keys may be at risk — with stolen access potentially reusable even months later.

Report: https://t.co/VVWC1yjp5t

[CloudSEK @cloudsek]

France-linked underground cyber activity has surged more than 4X in two years. What is driving the rise, and which sectors face the greatest risk?Explore CloudSEK’s latest threat report:
https://t.co/l0ahn0tWjj

[CloudSEK @cloudsek]

CloudSEK has partnered with Tech Mahindra to deliver AI-driven threat intelligence, attack surface monitoring, and digital risk protection — helping enterprises spot risks earlier, respond faster, and stay regulation-ready.

https://t.co/6u28bXCHqU

[CloudSEK @cloudsek]

Business phone systems are under attack. CloudSEK recorded 1.86M credential attempts and nearly 90,000 suspected toll-fraud calls in 18 days, exposing 277,632 attacker-used passwords.

https://t.co/DwJq9sZqy7

[CloudSEK @cloudsek]

FortiBleed: Hype vs Reality

Claims say 21k+ domains breached, but CloudSEK found the truth:
❌ Not a zero-day, just brute-forcing
📉 Only 148 actually compromised
🛡️ Secure your admin interfaces

Full analysis & IoCs: https://t.co/XvRnglo2B6

[CloudSEK @cloudsek]

Phishing is moving beyond stolen passwords.
CloudSEK uncovered BlueKit, a PhaaS platform with 87 phishing kits, session theft, automated account takeover and P2P infrastructure built to evade detection.

Read the report: https://t.co/FFRMEIfSxQ

[CloudSEK @cloudsek]

An exposed attacker server revealed the machinery behind Operation Escaneo—a cyber campaign targeting government, financial and critical infrastructure across Mexico and LATAM.

CloudSEK maps the tools, exploits and data theft.

https://t.co/2rgJZo0Gvc

[CloudSEK @cloudsek]

Fake tickets. Stolen cards. OTP bypass.

CloudSEK uncovered a Chinese-origin FIFA World Cup 2026 fraud network using cloned ticket sites, live victim tracking and payment interception.

Could you spot the fake?

https://t.co/wVpErJiZqO

[CloudSEK @cloudsek]

IPL betting scams are going high-tech.

CloudSEK found 1,200+ illegal betting domains, AI deepfake promos, mule accounts, compromised govt sites, fake loan apps and ₹4.65 crore in rejected withdrawals from one backend alone.

Read: https://t.co/t9CbqV8DJH

[CloudSEK @cloudsek]

IPL fever is turning into scam season.

CloudSEK found 600+ fake IPL ticketing domains and 400+ fake streaming sites targeting fans with fake QR tickets, payment traps and malware built to steal passwords, browser data and crypto wallets.

Read: https://t.co/bFofzaxum9

[CloudSEK @cloudsek]

New supply chain threat uncovered
CloudSEK TRIAD found an npm campaign using crypto-javascri, a typosquatted package impersonating crypto-js.
It steals npm/GitHub credentials, hijacks maintainer accounts, and uses Tor-based C2 to stay harder to disrupt.

https://t.co/akr2RpJeDg