08-Oct-2026 Google, MonsterCloud and npm Supply Chain Attacks Expose New Threats

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Each episode delivers concise, actionable intelligence for CISOs, security leaders, and business decision-makers. Today’s briefing covers five developments with direct implications for trust, resilience, and risk: 1. **Domain registry hijacking:** Attackers compromised Ghana’s .gh, Sierra Leone’s .sl, and American Samoa’s .as registries to obtain unauthorized HTTPS certificates for Google and YouTube lookalikes. Chrome blocked the certificates, but the incident highlights the risk of DNS and certificate-chain failures; organizations should monitor certificate logs and enforce strict CAA policies. 2. **Ransomware recovery fraud:** U.S. prosecutors charged MonsterCloud executive Zohar Pinhasi with allegedly overcharging ransomware victims while misrepresenting how their payments were used. The case, involving more than $19 million in alleged collections, underscores the need to vet recovery providers and maintain executive oversight during crisis response. 3. **PoeLLM botnet:** Researchers say malware exploiting exposed open-source AI services has compromised more than 3,400 servers, using them to scan for vulnerabilities and mine cryptocurrency. The campaign could also enable remote code execution and token abuse, raising risks for organizations deploying AI and cloud services without adequate exposure management. 4. **Phishing aimed at AI assistants:** Attackers are embedding hidden instructions in phishing emails to manipulate inbox-summary and triage tools, using techniques such as invisible text and encoded content. Security programs must now protect both employees and the AI systems influencing their decisions, particularly against credential theft and fraudulent payment requests. 5. **MALFEX npm supply-chain campaign:** Eight malicious packages downloaded more than 40,000 times delivered the Overlord RAT and other malware to Windows systems. The campaign demonstrates how trusted developer ecosystems can enable covert theft of credentials, browser data, messaging accounts, and cryptocurrency assets. Hacked dAily turns the day’s cyber developments into clear business and security insight—helping leaders act before emerging threats become material incidents. Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.