2026年5月28日の
セキュリティ情報

Subject: [Security Alert] Beware of Fake AI Tool Installers (ChatGPT/Claude)

Dear employees,

We have received reports of malware being distributed through fake installation programs masquerading as popular AI tools like ChatGPT and Claude.

Requested Actions:
1. Only download software and plugins from official websites (e.g., openai.com, anthropic.com).
2. Do not install software from links provided in YouTube videos or unofficial third-party platforms.
3. If you suspect you have installed an unofficial version of these tools, please contact the IT department immediately.

Deadline: Immediate

Subject: [Security Alert] Supply Chain Compromise in Daemon Tools Lite, TanStack Router, and Nx Console

Dear IT/Security Team,

CISA has added three vulnerabilities to the KEV catalog resulting from supply chain attacks where malicious code was injected into legitimate software.

■ Overview
Attackers compromised distribution channels and GitHub Actions to publish malicious packages and installers, some of which carried valid digital signatures.

■ Affected Products
- Daemon Tools Lite (Versions 12.5.0.2421 to 12.5.0.2434)
- TanStack Router (NPM package)
- Nx Console (VS Code extension)

■ Action Items
1. Audit internal and development environments for the presence of the affected software versions.
2. Update affected software to the latest secure versions immediately.
3. Review network logs for unauthorized connections to suspicious domains associated with these tools.

■ Reference
- CISA Known Exploited Vulnerabilities (KEV) Catalog

Priority: High
Deadline: Immediate

Subject: [Security Alert] Glassworm Botnet Supply Chain Attack

Dear IT/Security Team,

We are sharing information regarding the Glassworm botnet campaign targeting software developers.

■ Overview
The Glassworm botnet has been distributing malware via fake IDE extensions, malicious npm/Python packages, and compromised GitHub repositories. While four C2 servers have been taken down by a coalition of CrowdStrike, Google, and Shadowserver, the campaign highlights a significant risk to CI/CD pipelines and cloud credentials.

■ Scope
- Users of IDEs such as VS Code, Cursor, Windsurf, and VSCodium.
- Development environments utilizing npm and Python packages.
- Developers managing GitHub repositories.

■ Recommended Actions
1. Audit and remove unauthorized or suspicious IDE extensions from development environments.
2. Verify the integrity of dependencies in npm and Python projects to detect typosquatting or malicious packages.
3. Enforce Multi-Factor Authentication (MFA) and rotate credentials for developer and cloud administrative accounts.

■ Reference
- CrowdStrike Counter Adversary Operations Report

Priority: High
Deadline: Immediate

Subject: [Security Alert] Risk of Data Exposure via Misconfigured Cloud Storage

Dear IT/Security Team,

We are sharing information regarding a widespread issue of misconfigured cloud storage buckets.

■ Overview
Recent research by Mysterium VPN found over 530,000 public cloud buckets across AWS, Azure, and GCP, exposing approximately 19.6 billion files. A significant number of these files contain sensitive data such as .env files, private keys, and database backups, which can be leveraged by attackers for further compromise.

■ Scope
- Environments utilizing AWS S3, Google Cloud Storage, Microsoft Azure Blob Storage, DigitalOcean Spaces, and Alibaba Cloud OSS.

■ Action Plan
1. Audit all cloud storage bucket permissions to ensure that "Public Access" is not enabled unintentionally.
2. Verify that sensitive data (API keys, passwords, private keys, DB backups) are stored with strict access controls (e.g., IAM policies).
3. If any public exposure is detected, immediately restrict access and rotate all compromised credentials.

■ Reference
- Mysterium VPN Research Report

Priority: High
Deadline: Immediate