OpenAI shared details about a GitHub Actions process used for signing their macOS applications. This process downloaded the harmful Axios library on March 31st. They stated that no user information or internal systems were affected.
“To be extra cautious, we’re taking actions to secure the process that verifies our macOS apps as genuine OpenAI products,” OpenAI announced in a statement last week. “Our investigation found no evidence that OpenAI user data was accessed, our systems or intellectual property were compromised, or our software was altered.”
This information was released shortly after Google’s Threat Intelligence Group (GTIG) linked the supply chain attack on the widely used npm package to a North Korean hacking group they call UNC1069.
The attack allowed the hackers to take over the package maintainer’s npm account and release two corrupted versions (1.14.1 and 0.30.4). These versions included a malicious component called “plain-crypto-js,” which installed a cross-platform backdoor named WAVESHAPER.V2, targeting Windows, macOS, and Linux systems.
The AI company explained that a GitHub Actions process used for macOS app signing downloaded and executed Axios version 1.14.1. This process had access to the certificate and authentication materials used for signing ChatGPT Desktop, Codex, Codex CLI, and Atlas.
“Our investigation suggests that the signing certificate within this process was likely not successfully stolen by the malicious code. This is due to the timing of the code’s execution, how the certificate was added to the process, the order of events, and other preventive measures,” the company stated.
Although no data theft was confirmed, OpenAI is treating the certificate as compromised and is revoking and replacing it. Consequently, older versions of their macOS desktop apps will no longer receive updates or support after May 8, 2026.
This also implies that macOS security features will automatically block apps signed with the old certificate, preventing them from being downloaded or opened. The earliest versions signed with the updated certificate are listed below:
As part of its recovery efforts, OpenAI is also collaborating with Apple to prevent software signed with the old certificate from being newly authenticated. The 30-day period until May 8, 2026, aims to minimize disruption for users and provide them sufficient time to update to the newest version.
“If the certificate had been successfully compromised, malicious actors could use it to sign their own code, making it appear as genuine OpenAI software,” OpenAI stated. “We’ve stopped new software authentications using the old certificate. Therefore, new software signed with the old certificate by an unauthorized party will be blocked by macOS security features unless a user manually overrides them.”
The Axios breach, affecting a widely used HTTP client library, was among two significant supply chain attacks in March targeting the open-source community. The other incident targeted Trivy, a vulnerability scanner maintained by Aqua Security, resulting in widespread impact across five ecosystems, affecting numerous popular libraries that depend on it.
This attack, attributed to a cybercriminal group known as TeamPCP (aka UNC6780), implemented a credential stealer named SANDCLOCK to extract sensitive information from developer environments. The hackers then used the stolen credentials to compromise npm packages and distribute a self-propagating worm called CanisterWorm.
Days later, the group used secrets obtained from the Trivy intrusion to inject the same malware into two GitHub Actions processes managed by Checkmarx. Following this, they released malicious versions of LiteLLM and Telnyx on the Python Package Index (PyPI), both of which utilize Trivy in their CI/CD pipeline.
“The Telnyx compromise demonstrates a continuing evolution in TeamPCP’s supply chain activity, with adjustments to their tools, delivery methods, and platform coverage,” Trend Micro noted in an analysis of the attack.
“In only eight days, the actor shifted across security scanners, AI infrastructure, and telecommunications tools, evolving their delivery from inline Base64 to .pth auto-execution, and ultimately to split-file WAV steganography, while also expanding from Linux-only to dual-platform targeting with Windows persistence.”
On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named “msbuild.exe.” This executable uses various obfuscation methods to avoid detection and extracts DonutLoader (a shellcode loader) from a PNG image within the binary to load a fully functional trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.
Further analyses of the campaign, now identified as CVE-2026-33634, have been published by several cybersecurity vendors:
TeamPCP’s wave of supply chain attacks may have ended, but the group has since turned to profiting from existing credential harvests by working with other financially motivated groups such as Vect, LAPSUS$, and ShinyHunters. Evidence suggests the hackers have also launched their own ransomware operation under the name CipherForce.
These efforts have been boosted by TeamPCP’s use of stolen data to access cloud and software-as-a-service (SaaS) environments, marking a new escalation in the campaign. To this end, the cybercrime group has been verifying stolen credentials using TruffleHog, performing discovery operations within 24 hours of validation, extracting more data, and attempting lateral movement to gain access to the broader network.
“The credentials and secrets stolen in the supply chain attacks were quickly validated and utilized to explore victim environments and exfiltrate additional data,” Wiz researchers stated. “While the speed at which they were used suggests it was the work of the same threat actors responsible for the supply chain operations, we cannot rule out the secrets being shared with other groups and used by them.”
Google has warned that “hundreds of thousands of stolen secrets” could be circulating as a result of the Axios and Trivy attacks. This could lead to more software supply chain attacks, SaaS environment compromises, ransomware and extortion attempts, and cryptocurrency theft in the short term.
Two organizations confirming they were compromised through the Trivy supply chain attack are AI data training startup Mercor and the European Commission. The company has not specified the impact, but the LAPSUS$ extortion group listed Mercor on its leak site, claiming to have stolen about 4TB of data. The Mercor breach has prompted Meta to suspend its work with the company, according to a report from WIRED.
Earlier this month, CERT-EU revealed that the hackers used the stolen AWS secret to extract data from the Commission’s cloud environment. This included data related to websites hosted for up to 71 clients of the Europa web hosting service as well as outbound email communications. The ShinyHunters group has since made the stolen dataset publicly available on its dark web leak site.
GitGuardian’s analysis of the Trivy and LiteLLM supply chain attacks and their spread through dependencies and automation pipelines revealed that 474 public repositories executed malicious code from the compromised “trivy-action” workflow, and 1,750 Python packages were configured to automatically pull the infected versions.
“TeamPCP is intentionally targeting security tools that operate with elevated privileges by design. Compromising these tools gives the attacker access to highly sensitive environments within the organization, as security tools are generally granted broad access by design,” Brett Leatherman, Assistant Director of Cyber Division at the U.S. Federal Bureau of Investigation (FBI), wrote on LinkedIn.
These supply chain attacks are dangerous because they exploit the trust developers have when downloading packages and dependencies from open-source repositories. “Trust was assumed where it should have been verified,” said Mark Lechner, Chief Information Security Officer at Docker.
“Organizations that experienced minimal damage from these incidents already began replacing implicit trust with explicit verification at every level of their stack. This includes verified base images instead of community pulls, pinned references instead of mutable tags, scoped and short-lived credentials instead of long-lived tokens, and sandboxed execution environments instead of wide-open CI runners.”
Both Docker and the Python Package Index (PyPI) maintainers outlined a list of recommendations for developers to counter such attacks:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also added CVE-2026-33634 to its Known Exploited Vulnerabilities (KEV) catalog. This requires Federal Civilian Executive Branch (FCEB) agencies to apply the necessary mitigations by April 9, 2026.
“The number of recent software supply chain attacks is overwhelming,” stated Charles Carmakal, Chief Technology Officer of Mandiant Consulting at Google. “Defenders need to pay close attention to these campaigns. Enterprises should set up dedicated projects to assess the existing impact, remediate, and harden against future attacks.”
#after #app #axios #chain #hack. #link #macos #news #openai #revoked #security #supply — News
© Bulletproof Servers. All rights reserved.