Rodrigo Jorge

Rodrigo Jorge, Cybersecurity Teacher, Speaker and Writer. My family and Triathlon!

[ClaudeDevs @ClaudeDevs]

As a result of a US government directive, we are suspending access to Claude Fable 5 for all users. You can continue to use all other Claude models.

Here’s what this means for you:

Across Claude products, new sessions will run on your selected default model or Opus 4.8, and existing Fable 5 sessions will end with an error.

On the Claude Platform, requests to Fable 5 will also return an error. Please update your integrations to other Claude models.

We know this is a disruption to your workflows; we appreciate your patience and support.

[Rodrigo Jorge @rodrigojorge]

@aakashgupta Cybersecurity is just about people!

[Aakash Gupta @aakashgupta]

North Korean intelligence agents built an entire fake company to compromise one JavaScript developer. And it worked.

UNC1069 didn't hack Axios. They befriended its maintainer. They cloned a real company founder's identity, built a branded Slack workspace with fake employee profiles and LinkedIn post channels, then scheduled a Microsoft Teams call with what appeared to be a full team. During the call, a fake error message said his system needed an update. He installed it. That update was the RAT.

From one developer's laptop, they had everything: npm credentials, publishing access, the keys to a package installed in 80% of cloud environments. Axios gets 100 million downloads per week. The attackers published two poisoned versions at 12:21 AM UTC on a Sunday night, tagging both the latest and legacy branches within 39 minutes. The malicious dependency had been pre-staged 18 hours earlier with a clean decoy version to build registry history. Three separate RAT payloads were pre-built for macOS, Windows, and Linux. The malware self-deleted after execution to erase forensic evidence.

The poisoned versions were live for about three hours before npm pulled them. Huntress observed 135 endpoints across all operating systems calling the attacker's command-and-control server during that window. Wiz found the malicious versions in roughly 3% of environments scanned. Every affected machine needs full credential rotation: npm tokens, AWS keys, SSH keys, CI/CD secrets, everything in .env files.

The part that keeps getting worse: this isn't isolated. The same threat cluster compromised Trivy (a security scanner), KICS, LiteLLM, and multiple GitHub Actions in the two weeks before Axios. Google estimates hundreds of thousands of stolen secrets are now circulating from these combined attacks. The maintainer had 2FA enabled. He said himself: "I have 2FA/MFA on practically everything." The exact method of token compromise is still undetermined.

One person. One fake Teams call. 100 million weekly downloads weaponized in under three hours. The npm ecosystem runs on mass trust in individual maintainers who volunteer their time, and North Korean intelligence now has a repeatable playbook for turning that trust into a delivery mechanism.

[Rodrigo Jorge @rodrigojorge]

Trabalha com ou é entusiasta da Conscientização, Comportamento e Cultura de Segurança e Privacidade? Garanta seu lugar na HumanConf que será dia 26/10/2024, Sábado, em São Paulo/SP? Inscrições 🔗 https://t.co/Z9pbhbEJlT
#humanconf #conscientização #awareness #cibersegurança

[Rodrigo Jorge @rodrigojorge]

Ping...

[Yuri Diogenes @yuridiogenes]

When someone says: I have SIEM, I don't need a CNAPP!

@rodrigojorge @RNarezzi

Learn more about CNAPP and why you need it here:
https://t.co/MBOjj9iojN

[Felipe Pr0teus @pr0teusbr]

Dia 16/05 eu e o @spookerlabs faremos um mini-treinamento(8h) sobre #osquery e #endpoint monitoring. As inscrições possuem um valor simbólico e o arrecadado será doado para ajudar no combate ao #Covid_19! #blueteam #security @kolide
https://t.co/KRFPXEkzTM

[Rodrigo Jorge @rodrigojorge]

@officialmcafee My BFF

[Rodrigo Jorge @rodrigojorge]

Palestra e Painel “Hacker career Fair” na BSidesSP! Foi top! #0dayiscoming #Iknowanchises #BSidesSP

[Rodrigo Jorge @rodrigojorge]

@ystscon See you soon YSTS!!!

[Rodrigo Jorge @rodrigojorge]

Muito orgulho fazer parte desta da Família Neoway! Parabéns a todas e todos! #neolovers https://t.co/r4t7B7i832

[Rodrigo Jorge @rodrigojorge]

#GPDR https://t.co/wwbhtJSzpP

[Rodrigo Jorge @rodrigojorge]

#neoway #neolovers #gentefeliz #talentawards https://t.co/IOm1SqL3OU

[Rodrigo Jorge @rodrigojorge]

https://t.co/INu7RSV9I3

[Rodrigo Jorge @rodrigojorge]

gentefeliz #paixão #talentawards #neolovers #neoway https://t.co/Ms1FCxnvQJ

[Marc Rogers @marcwrogers]

There was a reason for every one of these rules.

[Rodrigo Jorge @rodrigojorge]

@spookerlabs @voeazul PQP @voeazul é vergonhosa!

[Rodrigo Jorge @rodrigojorge]

#DEFCON 26 is over and let’s get back to reality!

[Rodrigo Jorge @rodrigojorge]

DEFCON 26
Congrats for @Sidragon1 for excellent talk at SE Village! https://t.co/5KSF7ZmidB

[Rodrigo Jorge @rodrigojorge]

Some pics of DEFCON 26 https://t.co/U7Ox9IGFqs