Ledger has ordered distributors across Southeast Asia and Hong Kong to suspend hardware wallet sales following supply-chain tampering incidents.
Ledger has confirmed that hardware implants in its signers, sold through a reseller, allowed attackers to intercept 24-word recovery phrases. On-chain investigators estimate losses at $86 million.
Microsoft has detailed the NeedyMantis malware framework, used by China-based actors to maintain long-term access following the Daemon Tools supply chain attack.
Highly sophisticated malware has been identified within npm packages, demonstrating advanced capabilities to evade established security defences.
Threat actors have compromised MemTensor packages on npm and PyPI to deploy the sckit credential stealer, targeting sensitive cloud and developer secrets.
