CloudSEK

AI supply chain security is the practice of protecting every external component an AI system depends on, from training datasets and pre-trained models to the packages, build pipelines, gateways, and vendors that assemble them. The reason it commands attention now comes down to leverage. An attacker who corrupts one upstream component reaches thousands of downstream environments at once, riding the distribution channels every build system trusts by default.

An operator has spent the summer of 2026 publishing malicious packages to the public npm registry under names that belong to somebody else. Not names resembling popular libraries, which is the usual pattern, but the internal package names of one company. We track the activity as TXTBOOK. It began on PyPI, moved into npm with its execution trigger rebuilt for the new ecosystem, and now runs to 993 npm packages.

Executive Summary Cloudsek telemetry confirms a sustained, high-volume wave of France-targeted data leaks, credential dumps, ransomware victim advisories, and hacktivist disruption activity across several underground forums and channels.

Back BlueKit is turning phishing into a subscription business, offering 87 ready-made kits, automated account takeover and stealthy peer-to-peer infrastructure. CloudSEK’s investigation reveals how this mature PhaaS platform helps even low-skilled criminals target banks, cloud services and global brands. Subscribe to CloudSEK Resources Get the latest industry news, threats and resources.

Bengaluru, India: CloudSEK today announced a partial exit by early investor Exfinity Venture Partners. The transaction delivered a 13x multiple on invested capital (MOIC) and an internal rate of return (IRR) of more than 40%, through a secondary sale to existing investors. CloudSEK is an AI-native predictive cyber intelligence platform that identifies attack paths and initial access vectors before they are exploited. Exfinity continues to hold a meaningful stake.

Executive Summary The ip6.arpa TLD exists for one purpose: reverse DNS lookups. It was never designed to host websites, serve content, or point to IPv4 addresses. That makes it invisible to most security tools - and that is exactly why threat actors have started using it. In February 2026, Infoblox documented the known exploitation of this blind spot attackers were placing wildcard A records inside ip6.arpa reverse DNS zones, then embedding those zones as URLs in phishing emails.

🚀 CloudSEK becomes first Indian origin cybersecurity company to receive investment from US state fund

The mobile threat landscape has undergone a critical evolution, shifting from Application Modification (repacking APKs) to Runtime Environment Manipulation via the LSPosed framework. This new attack vector allows threat actors to hijack legitimate, unmodified payment applications by "gaslighting" the underlying Android operating system.

Executive Briefing On February 28, 2026, the United States and Israel jointly launched Operation Epic Fury, a coordinated pre-emptive military strike against Iranian nuclear and military infrastructure across Tehran, Isfahan, and Qom. Iran responded within hours with ballistic missile strikes against US military bases in Bahrain, Qatar, Kuwait, and the UAE.

Application security best practices protect software from vulnerabilities across development, deployment, and runtime environments. Modern applications operate across APIs, cloud platforms, and distributed systems where a single weakness can expose critical data. Growing attack complexity and expanding digital ecosystems have made secure software development a business priority.