CloudSEK is a contextual AI company that predicts Cyber Threats. Combining the power of Cyber,Brand & Attack Surface monitoring to give context to Digital Risk
Singapore
Joined October 2015
- Tweets1.2K
- Following76
- Followers2.5K
- Likes364
Online gambling didn’t end when Cambodia, Myanmar and the Philippines cracked down. It moved to Indonesia. A new CloudSEK report follows the money: cloudsek.com/whitepapers-rep…
🤖 Made with AI
Fake AI SDKs. Hidden Windows RAT. Seven malicious npm packages.
CloudSEK uncovered NEBULA, a supply-chain campaign deploying malware capable of stealthy remote access and surveillance.
Two packages were still downloadable as of Oct 8.
Read: cloudsek.com/blog/nebula-fak…
One exposed server gave up an entire ransomware operation.
A Gentlemen affiliate breached 2 dozen+ orgs across 6 countries via stolen CI/CD secrets, then ran attacks through an AI assistant over MCP, a technique with no prior public reporting.
cloudsek.com/blog/caught-in-…
What if attackers could rent their way into a victim’s infrastructure?
CloudSEK uncovered VHX Harvester targeting vast ai — scanning 13,368 endpoints, deploying 25 bridge agents and reaching a root shell.
Read Part 2: cloudsek.com/blog/tophit-par…
85 malicious npm packages. Just over 3 minutes to publish them.
CloudSEK found a typosquatting campaign built to surface in search and autocomplete, then connect systems to a remote command channel.
Read Part 1: cloudsek.com/blog/tophit-npm…
A malicious npm package stayed undetected for 14 months.
CloudSEK’s MALFEX investigation reveals a supply-chain campaign using RATs, credential stealers and Solana-based C2 — with parts remaining reachable even after takedowns.
cloudsek.com/blog/malfex-mal…
A legitimate npm package was compromised — and the malicious release still carried valid provenance. CloudSEK uncovered GHAPPIER, spanning 65 repositories, 73 infected files and 22 accounts.
Full research: cloudsek.com/blog/ghappier-m…
A routine npm install can cross from WSL into Windows.
CloudSEK’s BRIDGEHEAD investigation found 40 typosquatted npm packages delivering a payload targeting crypto wallets, browser credentials and Telegram sessions.
Read: cloudsek.com/blog/bridgehead…
CloudSEK uncovered an exposed attacker workspace with 142K+ files, revealing AI agents being used to automate offensive hacking. Evidence includes 8,996 compromised WordPress sites, stolen credentials and crypto wallet data.
cloudsek.com/blog/ai-agent-d…
2,500+ organisations potentially exposed in a major AI supply-chain breach involving LiteLLM. Cloud credentials, source-code access and AI/API keys may be at risk — with stolen access potentially reusable even months later.
Report: cloudsek.com/blog/ai-supply-…
France-linked underground cyber activity has surged more than 4X in two years. What is driving the rise, and which sectors face the greatest risk?Explore CloudSEK’s latest threat report:
cloudsek.com/blog/france-dar…
CloudSEK has partnered with Tech Mahindra to deliver AI-driven threat intelligence, attack surface monitoring, and digital risk protection — helping enterprises spot risks earlier, respond faster, and stay regulation-ready.
cloudsek.com/ancmt/cloudsek-…
Business phone systems are under attack. CloudSEK recorded 1.86M credential attempts and nearly 90,000 suspected toll-fraud calls in 18 days, exposing 277,632 attacker-used passwords.
cloudsek.com/blog/the-5060-s…
FortiBleed: Hype vs Reality
Claims say 21k+ domains breached, but CloudSEK found the truth:
❌ Not a zero-day, just brute-forcing
📉 Only 148 actually compromised
🛡️ Secure your admin interfaces
Full analysis & IoCs: cloudsek.com/blog/inside-the…
Phishing is moving beyond stolen passwords.
CloudSEK uncovered BlueKit, a PhaaS platform with 87 phishing kits, session theft, automated account takeover and P2P infrastructure built to evade detection.
Read the report: cloudsek.com/blog/bluekit-ph…
An exposed attacker server revealed the machinery behind Operation Escaneo—a cyber campaign targeting government, financial and critical infrastructure across Mexico and LATAM.
CloudSEK maps the tools, exploits and data theft.
cloudsek.com/blog/operation-…
Fake tickets. Stolen cards. OTP bypass.
CloudSEK uncovered a Chinese-origin FIFA World Cup 2026 fraud network using cloned ticket sites, live victim tracking and payment interception.
Could you spot the fake?
cloudsek.com/blog/chinese-or…
IPL betting scams are going high-tech.
CloudSEK found 1,200+ illegal betting domains, AI deepfake promos, mule accounts, compromised govt sites, fake loan apps and ₹4.65 crore in rejected withdrawals from one backend alone.
Read: cloudsek.com/blog/illegal-ip…
IPL fever is turning into scam season.
CloudSEK found 600+ fake IPL ticketing domains and 400+ fake streaming sites targeting fans with fake QR tickets, payment traps and malware built to steal passwords, browser data and crypto wallets.
Read: cloudsek.com/blog/hit-wicket…
New supply chain threat uncovered
CloudSEK TRIAD found an npm campaign using crypto-javascri, a typosquatted package impersonating crypto-js.
It steals npm/GitHub credentials, hijacks maintainer accounts, and uses Tor-based C2 to stay harder to disrupt.
cloudsek.com/blog/inside-a-t…
