Skip to content
March 2026 Page 19

March 2026

TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise

TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise

TeamPCP, the threat actor behind the recent compromises of Trivy and KICS, has now compromised a popular Python package named litellm, pushing two malicious versions containing a credential harvester, a Kubernetes lateral movement toolkit, and… 

Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR

Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR

Ravie LakshmananMar 24, 2026Endpoint Security / Social Engineering A large-scale malvertising campaign active since January 2026 has been observed targeting U.S.-based individuals searching for tax-related documents to serve rogue installers for ConnectWise ScreenConnect that drop… 

Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner

Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner

Ravie LakshmananMar 24, 2026Malware / Endpoint Security An ongoing phishing campaign is targeting French-speaking corporate environments with fake resumes that lead to the deployment of cryptocurrency miners and information stealers. “The campaign uses highly obfuscated…