Security Affairs Malware Newsletter Round 90 Highlights Surge in Supply‑Chain Attacks, Targeted Malware Campaigns and New Threat‑Actor Toolsets
What Happened — The March 29 2026 edition of Security Affairs’ Malware Newsletter aggregates more than a dozen fresh threat reports, including a Trivy‑based supply‑chain compromise of Docker images, a new “VoidStealer” Chrome‑debugger RAT, Iranian state‑linked actors using Telegram C2, and a novel WebRTC skimmer aimed at a $100 B‑plus automotive OEM.
Why It Matters for TPRM —
- Supply‑chain compromises (e.g., Trivy/Docker) can cascade to any downstream SaaS or cloud provider you rely on.
- Targeted malware leveraging legitimate platforms (Chrome, Telegram) raises the risk of credential theft from privileged users at partner organizations.
- Emerging toolsets (BPFdoor, CanisterWorm) indicate a shift toward “sleeper‑cell” capabilities in telecom and critical‑infrastructure networks, expanding the attack surface of third‑party service providers.
Who Is Affected — Cloud‑infrastructure providers, SaaS vendors, automotive OEMs, telecom operators, and any organization that integrates third‑party Docker images or uses Chrome extensions for internal workflows.
Recommended Actions —
1. Audit all third‑party Docker images and enforce signed‑image verification.
2. Review Chrome extension usage policies; block unsigned extensions on corporate devices.
3. Validate that any Telegram‑based communications with vendors are authenticated and monitored.
4. Update BPF and kernel‑level monitoring tools to detect dormant “sleeper‑cell” code.
Technical Notes —
- Trivy Supply‑Chain Attack – malicious layers injected into popular Docker images; vector: VULNERABILITY_EXPLOIT via compromised image registry.
- VoidStealer – Chrome debugging API abused to extract cookies and session tokens; vector: MALWARE.
- Telegram C2 – Iranian actors use encrypted Telegram bots to deliver custom payloads; vector: PHISHING / STOLEN_CREDENTIALS.
- WebRTC Skimmer – bypasses standard network controls, exfiltrates credit‑card data from automotive telematics; vector: MALWARE.