Supply-chain package poisoning via npm, PyPI, and Composer dominated the U.S. cross-sector threat picture this week, alongside BEC wire-transfer fraud targeting mid-tier financial institutions and continued RMM tooling abuse in MSSP environments.
U.S. Sector Weekly Threat Brief — 2026-05-23 → 2026-05-30 | Protos Labs
@import url('https://fonts.googleapis.com/css2?family=Montserrat:wght@400;600;700;800&family=Hind:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap');
*, *::before, *::after { box-sizing: border-box; }
:root {
--brand-primary: #7CFF4D;
--brand-accent: #DCFF50;
--brand-violet: #8B7CFF;
--canvas: #0A0E1A;
--canvas-2: #121826;
--elevated: #1F2937;
--border: #1F2937;
--border-strong: #2A3444;
--fg1: #F5F7FA;
--fg2: #8A94A6;
--success: #7CFF4D;
--warning: #FFD23F;
--danger: #FF5C6A;
--font-display: 'Montserrat', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
--font-body: 'Hind', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
--font-mono: 'JetBrains Mono', 'SFMono-Regular', Consolas, 'Liberation Mono', monospace;
--sp-1:4px;--sp-2:8px;--sp-3:12px;--sp-4:16px;--sp-5:24px;--sp-6:32px;--sp-7:48px;--sp-8:64px;--sp-9:96px;--sp-10:128px;
--r-xs:2px;--r-sm:4px;--r-md:8px;
--dur-base:200ms;--ease-standard:cubic-bezier(0.4,0,0.2,1);
}
html, body { margin:0; padding:0; background:var(--canvas); color:var(--fg1); font-family:var(--font-body); font-size:16px; line-height:1.6; -webkit-font-smoothing:antialiased; }
h1,h2,h3,h4,h5,h6 { font-family:var(--font-display); color:var(--fg1); line-height:1.2; letter-spacing:-0.01em; }
a { color:var(--brand-primary); text-decoration:none; }
a:hover { opacity:0.8; }
p { margin:0 0 16px; }
code { font-family:var(--font-mono); font-size:0.88em; color:var(--brand-primary); background:var(--canvas-2); padding:1px 6px; }
ol,ul { padding-left:22px; margin:0 0 16px; }
li { margin-bottom:6px; }
strong,b { font-weight:700; }
table { border-collapse:collapse; width:100%; }
th,td { padding:8px 12px; border:1px solid var(--border); font-size:14px; }
th { background:var(--canvas-2); font-family:var(--font-mono); font-size:11px; letter-spacing:0.15em; text-transform:uppercase; color:var(--brand-primary); text-align:left; }
td { color:var(--fg2); }
tr:nth-child(even) td { background:rgba(255,255,255,0.02); }
.wrap { max-width:1120px; margin:0 auto; padding:0 24px; }
.article-head { background:var(--canvas-2); border-bottom:1px solid var(--border); padding:var(--sp-7) 0 var(--sp-6); }
.article-head-inner { display:flex; flex-direction:column; gap:var(--sp-3); }
.article-meta-strip { display:flex; align-items:center; gap:20px; margin-bottom:8px; }
.eyebrow { font-family:var(--font-mono); font-size:11px; letter-spacing:0.22em; text-transform:uppercase; color:var(--fg2); display:flex; align-items:center; gap:8px; }
.eyebrow .dot { width:6px; height:6px; background:var(--brand-primary); }
.eyebrow .sep { width:1px; height:10px; background:var(--border-strong); }
.eyebrow b { color:var(--fg1); }
.tlp-badge { display:inline-flex; align-items:center; gap:7px; font-family:var(--font-mono); font-size:11px; font-weight:700; letter-spacing:0.18em; text-transform:uppercase; border:1.5px solid var(--brand-primary); color:var(--brand-primary); padding:4px 10px; }
.tlp-badge .pulse { width:7px; height:7px; background:var(--brand-primary); flex-shrink:0; border-radius:50%; box-shadow:0 0 0 0 rgba(124,255,77,0.4); animation:pulseClear 2s infinite; }
@keyframes pulseClear { 0%{box-shadow:0 0 0 0 rgba(124,255,77,0.4)} 70%{box-shadow:0 0 0 7px rgba(124,255,77,0)} 100%{box-shadow:0 0 0 0 rgba(124,255,77,0)} }
.tlp-badge.amber { border-color: #E0A800; color: #E0A800; }
.tlp-badge.amber .pulse { background: #E0A800; box-shadow: 0 0 0 0 rgba(224,168,0,0.4); animation: pulseAmber 2s infinite; }
@keyframes pulseAmber { 0%{box-shadow:0 0 0 0 rgba(224,168,0,0.4)} 70%{box-shadow:0 0 0 7px rgba(224,168,0,0)} 100%{box-shadow:0 0 0 0 rgba(224,168,0,0)} }
.article-kicker { font-family:var(--font-mono); font-size:11.5px; letter-spacing:0.18em; text-transform:uppercase; color:var(--fg2); }
.article-title { font-size:clamp(28px,4vw,48px); font-weight:800; max-width:860px; margin:8px 0 4px; }
.article-deck { font-size:18px; line-height:1.65; color:var(--fg2); max-width:740px; margin:0; }
.article-deck b { color:var(--fg1); }
.meta-row { display:flex; flex-wrap:wrap; gap:24px 36px; padding:18px 0; border-top:1px solid var(--border); border-bottom:1px solid var(--border); margin:18px 0 8px; font-size:13.5px; }
.meta-row .item { display:flex; flex-direction:column; gap:4px; }
.meta-row .item .l { font-family:var(--font-mono); font-size:10px; letter-spacing:0.22em; text-transform:uppercase; color:var(--fg2); font-weight:600; }
.meta-row .item .v { color:var(--fg1); font-weight:600; }
.article-body { display:grid; grid-template-columns:220px 1fr; gap:48px; padding:var(--sp-7) 0 var(--sp-9); }
@media (max-width:900px) { .article-body { grid-template-columns:1fr; } .toc { display:none; } }
.toc { position:sticky; top:32px; height:fit-content; }
.toc-label { font-family:var(--font-mono); font-size:10px; letter-spacing:0.22em; text-transform:uppercase; color:var(--brand-primary); font-weight:700; margin-bottom:12px; }
.toc ol { padding-left:16px; margin:0; list-style:decimal; }
.toc li { margin-bottom:8px; font-size:13.5px; }
.toc a { color:var(--fg2); }
.toc a:hover { color:var(--fg1); }
.toc-foot { margin-top:24px; padding-top:16px; border-top:1px solid var(--border); font-family:var(--font-mono); font-size:10.5px; color:var(--fg2); }
.toc-foot .sub { letter-spacing:0.18em; text-transform:uppercase; }
.section-anchor { margin-bottom:48px; }
.section-num { font-family:var(--font-mono); font-size:11px; letter-spacing:0.22em; text-transform:uppercase; color:var(--brand-primary); margin-bottom:8px; }
h2 { font-size:clamp(22px,3vw,36px); font-weight:800; margin:0 0 20px; }
.hl { color:var(--brand-primary); }
.exec-grid { display:grid; grid-template-columns:1fr 1fr; gap:14px; margin:20px 0 24px; }
@media (max-width:640px) { .exec-grid { grid-template-columns:1fr; } }
.exec-card { background:var(--canvas-2); padding:22px 24px; border-top:3px solid var(--border); }
.exec-card.sev { border-top-color:#E2334C; }
.exec-card.conf { border-top-color:var(--brand-primary); }
.exec-card.period { border-top-color:#4d8cff; }
.exec-card.action { border-top-color:var(--brand-violet); }
.ec-label { font-family:var(--font-mono); font-size:10px; letter-spacing:0.22em; text-transform:uppercase; color:var(--fg2); font-weight:600; margin-bottom:8px; }
.ec-value { font-family:var(--font-display); font-size:24px; font-weight:800; color:var(--fg1); margin-bottom:8px; }
.ec-detail { font-size:13.5px; color:var(--fg2); margin:0; line-height:1.5; }
.key-insight { background:var(--canvas-2); border-left:3px solid var(--brand-primary); padding:14px 18px; margin:16px 0; }
.key-insight p { margin:0; font-size:15px; }
.findings-list, .actions-list { padding-left:22px; margin:6px 0 18px; }
.findings-list li, .actions-list li { margin-bottom:12px; line-height:1.55; }
.ioc { margin:16px 0; font-size:13px; }
h3.sector { font-size:26px; margin-top:56px; padding-top:32px; border-top:1px solid var(--border); font-weight:700; }
h3.sector .sec-tag { font-family:var(--font-mono); font-size:11px; letter-spacing:0.22em; text-transform:uppercase; color:var(--brand-primary); font-weight:700; display:block; margin-bottom:8px; }
h4.subsection { font-family:var(--font-display); font-weight:700; font-size:18px; letter-spacing:-0.01em; margin:28px 0 10px; }
.ctag { display:inline-block; padding:1px 7px; font-family:var(--font-mono); font-size:10.5px; font-weight:700; border-radius:2px; }
.ctag.cref { border:1px solid var(--border-strong); color:var(--fg2); }
a.artefact-link { font-family:var(--font-mono); font-size:0.92em; color:var(--brand-primary); border-bottom:1px dashed currentColor; padding-bottom:1px; cursor:pointer; }
a.artefact-link::before { content:'\25A2 '; margin-right:4px; opacity:0.6; }
.muted { color:var(--fg2); }
.chronology { margin:24px 0; }
.chron-grid { display:grid; grid-template-columns:repeat(4,1fr); gap:0; }
.chip { font-family:var(--font-mono); font-size:11px; font-weight:700; letter-spacing:0.1em; color:#fff; padding:5px 10px; margin-bottom:12px; }
.event-card { background:var(--canvas-2); border:1px solid var(--border); padding:16px; width:100%; }
.ec-title { font-family:var(--font-display); font-weight:700; font-size:14px; color:var(--fg1); margin-bottom:6px; }
.ec-body { font-size:13px; color:var(--fg2); margin:0; }
.other-artefacts { display:grid; grid-template-columns:repeat(2,1fr); gap:14px; margin:18px 0 28px; }
.other-artefacts a { position:relative; display:flex; flex-direction:column; padding:18px 20px 16px; border:1px solid var(--border); background:var(--canvas-2); text-decoration:none; color:inherit; }
.other-artefacts a:hover { border-color:var(--brand-primary); }
.other-artefacts a::before { content:''; position:absolute; left:-1px; top:-1px; bottom:-1px; width:3px; background:var(--brand-primary); }
.oa-label { font-family:var(--font-mono); font-size:10px; font-weight:700; letter-spacing:0.22em; text-transform:uppercase; color:var(--fg2); margin-bottom:6px; }
.oa-title { font-family:var(--font-display); font-weight:700; font-size:17px; color:var(--fg1); margin:0 0 8px; }
.oa-desc { font-size:13.5px; line-height:1.5; color:var(--fg2); margin:0 0 14px; }
.oa-foot { display:flex; justify-content:space-between; align-items:center; margin-top:auto; font-family:var(--font-mono); font-size:10.5px; letter-spacing:0.18em; text-transform:uppercase; color:var(--fg2); }
.oa-foot .open { color:var(--brand-primary); }
.am-backdrop { position:fixed; inset:0; z-index:100; background:rgba(4,6,12,0.74); backdrop-filter:blur(4px); display:none; align-items:flex-start; justify-content:center; padding:56px 24px; overflow-y:auto; }
.am-backdrop.is-open { display:flex; }
.am-window { position:relative; width:min(820px,100%); background:var(--canvas); border:1px solid var(--border-strong); box-shadow:0 24px 64px rgba(0,0,0,0.5); }
.am-window::before { content:''; position:absolute; left:-1px; right:-1px; top:-1px; height:3px; background:var(--brand-primary); }
.am-head { display:flex; align-items:center; justify-content:space-between; gap:20px; padding:22px 28px 18px; border-bottom:1px solid var(--border); }
.am-head .am-eyebrow { font-family:var(--font-mono); font-size:10.5px; letter-spacing:0.22em; text-transform:uppercase; color:var(--brand-primary); font-weight:700; margin-bottom:6px; display:block; }
.am-head h3 { font-family:var(--font-display); font-weight:700; font-size:22px; margin:0; }
.am-close { background:transparent; border:1px solid var(--border-strong); color:var(--fg2); font-family:var(--font-mono); font-size:13px; font-weight:700; width:36px; height:36px; cursor:pointer; }
.am-close:hover { color:var(--fg1); border-color:var(--fg1); }
.am-body { padding:22px 28px 26px; font-size:14.5px; line-height:1.6; color:var(--fg2); max-height:70vh; overflow-y:auto; }
.am-body p { margin:0 0 14px; }
.am-body b,.am-body strong { color:var(--fg1); }
.am-body h5 { font-family:var(--font-display); font-weight:700; font-size:13px; letter-spacing:0.04em; text-transform:uppercase; color:var(--brand-primary); margin:22px 0 8px; padding-bottom:6px; border-bottom:1px solid var(--border); }
.am-body ul { padding-left:20px; margin:8px 0 14px; }
.am-body ul li { margin-bottom:8px; line-height:1.55; }
.am-meta { display:grid; grid-template-columns:1fr 1fr; gap:8px 24px; padding:14px 0; border-top:1px solid var(--border); border-bottom:1px solid var(--border); margin-bottom:18px; font-size:12.5px; }
.am-meta .l { font-family:var(--font-mono); font-size:10px; letter-spacing:0.22em; text-transform:uppercase; color:var(--fg2); font-weight:700; }
.am-meta .v { color:var(--fg1); font-weight:600; }
.am-section-divider { display:flex; align-items:center; gap:14px; margin:32px 0 20px; }
.am-section-divider::before,.am-section-divider::after { content:''; flex:1; height:1px; background:var(--border); }
.am-section-tag { font-family:var(--font-mono); font-size:9.5px; font-weight:700; letter-spacing:0.24em; text-transform:uppercase; color:var(--brand-primary); border:1px solid var(--brand-primary); padding:3px 9px; opacity:0.6; }
.ws-meta-note { font-size:11.5px; color:var(--fg2); opacity:0.55; font-style:italic; margin:6px 0; }
Weekly threat intelligence · US region
Cross-sector intelligence for 2026-05-23 → 2026-05-30 shows elevated U.S. risk from supply-chain package poisoning (npm, PyPI, Composer credential stealers), BEC wire-transfer fraud targeting mid-tier financial institutions, and RMM tool abuse in MSSP environments.
AnalystProtos AI Threat Intelligence
Date2026-05-30
Reporting period2026-05-23 → 2026-05-30 (SGT, UTC+8)
RegionUS · 7-day window
Contents
Reporting window
2026-05-23 → 2026-05-30 (SGT, UTC+8).
§ 01 · Cross-sector position
Overall severity
High
Multiple sectors exposed to credential theft and supply-chain compromise.
Confidence
High
Key judgments corroborated across multiple independent sources.
Reporting period
2026-05-23 → 2026-05-30 (SGT, UTC+8)
7-day US sector window.
Recommended action
Dependency triage & credential rotation
Priority: out-of-cycle for impacted assets.
Bottom line: It is likely that the primary U.S. cross-sector risk for 2026-05-23 → 2026-05-30 was supply-chain package poisoning delivering credential stealers to government contractors, fintech build pipelines, and MSSP-managed developer environments simultaneously.
Key insight. Supply-chain package poisoning and nation-state credential theft campaigns continued to target U.S. federal, state, and local agencies. CISA advisories in-window cover actively-exploited network edge device vulnerabilities.
Recommended executive action: Apply all CISA KEV patches on emergency timeline. Review contractor access credentials and implement privileged access management.
TypeIndicatorNotes
Check CISA KEV catalog for new additions 2026-05-23 to 2026-05-30
Workstream artefact → workstream_government_agency_batch4.md
Key insight. Package poisoning attacks targeting fintech build pipelines and BEC-driven wire-transfer fraud are the primary U.S. FSI risks this week. Ransomware operators continue to target banks, insurers, and payment processors.
Recommended executive action: Audit npm/PyPI dependencies in fintech build pipelines. Enforce BEC-resistant controls on wire-transfer workflows (dual-approval, out-of-band verification).
TypeIndicatorNotes
Email compromise targeting finance approval workflows
Workstream artefact → workstream_financial_services_part5.md
Key insight. U.S. MSSPs face continued access-as-a-service underground market activity and RMM tool abuse. SOC platform and SIEM infrastructure targeting attempts observed in-window.
Recommended executive action: Validate RMM deployment configurations and enforce MFA on all remote management tooling. Review SIEM/SOC platform access controls.
TypeIndicatorNotes
Legitimate tools abused for persistent MSSP access
Workstream artefact → workstream_mssp_part2.md
Key insight. No confirmed named U.S. retail or hospitality breach in-window. DarkOwl dark-web intelligence confirms active underground services targeting U.S. retail and hospitality brands — loyalty fraud, bulk credential trading, and seasonal attack activity.
Recommended executive action: Increase ATO monitoring on loyalty portals and e-commerce platforms. Review POS system patching status at franchise and managed locations.
Workstream artefact → workstream_retail_hospitality_batch3.md
§ 06 · Cross-sector synthesis
Cross-sector analysis for 2026-05-23 → 2026-05-30 identifies supply-chain package poisoning as the primary unifying risk vector for U.S. organisations this week. Malicious packages distributed via npm, PyPI, and Composer deliver credential stealers targeting government contractors, fintech build pipelines, and MSSP-managed developer environments simultaneously.
Shared threat actor TTPs observed across sectors: legitimate tooling abuse (RMM tools, developer extensions) as persistence and lateral movement vectors; credential theft prioritised over immediate destructive outcomes; and active underground fraud-enablement ecosystem supporting retail and hospitality targeting.
Top prioritised actions for leadership: (1) Emergency audit of open-source dependencies in all build pipelines (npm, PyPI, Composer); (2) mandate phishing-resistant MFA across government and FSI; (3) validate MSSP RMM configurations; (4) review incident response plans for supply-chain compromise scenarios.
Workstream artefact → workstream_cross_sector_summary_final.md
§ 07 · Mitigations
PriorityActionOwnerFinding1Audit all open-source dependencies (npm, PyPI, Composer) in build pipelines; rotate exposed CI/CD secrets and cloud credentials.CISO / AppSecCross-sector2Apply all CISA KEV patches on emergency timeline; validate contractor access credential exposure.CISO / IT OpsFinding 1 (Gov)3Enforce dual-approval and out-of-band verification for wire-transfer workflows; brief finance teams on BEC surge.CFO / CISOFinding 2 (FSI)4Require MSSP partners to validate all RMM configurations and report within 24 hours.CISO / ProcurementFinding 3 (MSSP)
§ 08 · Technical annex
Malicious packages distributed via public registries contain credential stealers targeting CI/CD environment variables and developer secrets. Detection: use SBOM tooling (Syft, Trivy) to generate a dependency manifest; compare against known-malicious package lists from OSV (osv.dev). Rotate all secrets in CI/CD environments after detection.
BEC campaigns targeting U.S. financial institutions use compromised or spoofed email accounts to impersonate executives initiating wire transfer requests. Detection controls: DMARC/DKIM enforcement, wire-transfer dual-approval requiring out-of-band confirmation, and anomaly detection on transfer recipient accounts.
Threat actors sell persistent RMM tool access to U.S. MSSP environments on underground forums. Initial access typically obtained via credential stuffing or phishing of MSSP admin accounts. Detection: monitor for RMM sessions initiated outside normal business hours or from unusual geographies; enforce MFA on all RMM consoles.
§ 09 · Chronology
23 May
Package poisoning campaigns active
Malicious npm/PyPI/Composer packages with credential stealers distributed targeting U.S. sectors.
25 May
CrowdStrike FSI report published
CrowdStrike 2026 Financial Services Threat Landscape Report confirms continued FSI targeting patterns.
27 May
CISO Platform breach report
Multi-sector breach incidents involving MSSP-adjacent tooling and MSP-managed infrastructure reported.
29 May
Palo Alto Unit 42 IR report
2026 Unit 42 Global Incident Response Report published — confirms cross-sector credential theft priority.
§ 10 · Workstream artefacts
Raw collection and analysis artefacts from the underlying Protos AI investigation workstreams.
workstream_cross_sector
Overlapping threat actors, shared TTPs, supply-chain risks, and cross-sector risk outlook.
Final summaryOpen →
Government · Batch 4
workstream_government_agency
Supply-chain contractor targeting, nation-state activity, CISA KEV advisories.
4 batches collectedOpen →
Financial Services · Batch 5
workstream_financial_services
Package poisoning, BEC fraud, ransomware targeting FSI.
5 batches collectedOpen →
MSSPs · Part 2
workstream_mssp
Access-as-a-service market, RMM abuse, SOC platform targeting.
2 parts collectedOpen →
Retail & Hospitality · Batch 3
workstream_retail_hospitality
Underground fraud enablement, ATO patterns, loyalty program fraud.
3 batches collectedOpen →
§ 11 · References
#SourceType / NotesPublished1CISA / FBI / NSAGovernment advisories, KEV updates, and sector-specific guidance2026-05-23 – 2026-05-302CrowdStrike2026 Financial Services Threat Landscape Report2026-05-253Palo Alto Unit 422026 Global Incident Response Report2026-05-294Trend MicroAccess-as-a-service underground market analysis2026-05 (in-window)5DarkOwlDark-web intelligence for retail & hospitality sector findings2026-05 (in-window)6FS-ISAC / FFIECFinancial sector threat intelligence sharing and regulatory guidance2026-05 (in-window)7CISO Platform Breach ReportMulti-sector breach incident overview (27 May 2026)2026-05-27
TLP:AMBER — share with internal stakeholders and trusted sector partners only. Do not redistribute publicly.
{"government":{"eyebrow":"Workstream artefact · Government Agency","title":"workstream_government_agency","meta":{"Owner":"Protos AI","Confidence":"High","Window":"2026-05-23 → 2026-05-30 (SGT, UTC+8)","Classification":"TLP:AMBER"},"summary":"Government agency threat intelligence covering advisory-driven vulnerabilities, third-party data leaks, and nation-state activity.","batches":[{"tag":"Batch 1","title":"Government Agency — U.S. Consolidated Findings","source":"workstream_government_agency_batch4.md","content":"<h5>Government Agency — U.S. Weekly Collection (Batch 4)</h5><p>Package poisoning attacks targeting U.S. federal agencies and defense contractors. CISA advisories cover actively-exploited vulnerabilities in network edge devices. Nation-state actors continued targeting federal, state, and local agencies with spear-phishing and credential-based initial access.</p>"}]},"fsi":{"eyebrow":"Workstream artefact · Financial Services","title":"workstream_financial_services","meta":{"Owner":"Protos AI","Confidence":"Medium–High","Window":"2026-05-23 → 2026-05-30 (SGT, UTC+8)","Classification":"TLP:AMBER"},"summary":"Financial services threat intelligence covering package poisoning, BEC fraud, credential theft, and ransomware.","batches":[{"tag":"Part 1","title":"Financial Services — U.S. Weekly (Batch 5)","source":"workstream_financial_services_part5.md","content":"<h5>Financial Services — U.S. Weekly Collection (Batch 5)</h5><p>Malicious packages distributed via npm and PyPI targeting fintech build pipelines. Wire-transfer fraud via BEC targeting mid-tier financial institutions. Ransomware operators targeting U.S. banks, insurers, and payment processors. FFIEC, SOX, and PCI-DSS-regulated entities face increased audit and notification obligations.</p>"}]},"mssps":{"eyebrow":"Workstream artefact · MSSPs","title":"workstream_mssp","meta":{"Owner":"Protos AI","Confidence":"High","Window":"2026-05-23 → 2026-05-30 (SGT, UTC+8)","Classification":"TLP:AMBER"},"summary":"MSSP threat intelligence covering RMM tool abuse, access-as-a-service underground market, and SOC platform targeting.","batches":[{"tag":"Batch 1","title":"MSSPs — U.S. Consolidated Findings","source":"workstream_mssp_part2.md","content":"<h5>MSSP — U.S. Weekly Collection</h5><p>Trend Micro confirmed continued sale of MSSP/MSP access credentials on underground forums. RMM tool abuse (ScreenConnect, ConnectWise) targeting U.S. MSP environments. Attacks on SOC platforms and SIEM infrastructure observed in-window. A compromised MSSP can simultaneously expose multiple client environments.</p>"}]},"retail":{"eyebrow":"Workstream artefact · Retail & Hospitality","title":"workstream_retail_hospitality","meta":{"Owner":"Protos AI","Confidence":"Medium","Window":"2026-05-23 → 2026-05-30 (SGT, UTC+8)","Classification":"TLP:AMBER"},"summary":"Retail and hospitality threat intelligence covering underground fraud enablement and ATO patterns.","batches":[{"tag":"Batch 1","title":"Retail & Hospitality — U.S. (Batch 3)","source":"workstream_retail_hospitality_batch3.md","content":"<h5>Retail & Hospitality — U.S. Weekly Collection (Batch 3)</h5><p>DarkOwl confirmed underground activity: bulk stolen credentials for U.S. retail and hospitality brands, hotel loyalty fraud services, and merchant-payment abuse. No confirmed named U.S. retail/hospitality breach identified in-window. Seasonal attack spike patterns consistent with pre-summer travel period.</p>"}]},"cross_sector":{"eyebrow":"Workstream artefact · Cross-Sector Summary","title":"workstream_cross_sector_summary","meta":{"Owner":"Protos AI","Confidence":"High","Window":"2026-05-23 → 2026-05-30 (SGT, UTC+8)","Classification":"TLP:AMBER"},"summary":"Cross-sector analysis synthesising overlapping threat actors, shared vulnerabilities, and cross-sector TTPs.","batches":[{"tag":"Final","title":"Cross-Sector Summary — Final","source":"workstream_cross_sector_summary_final.md","content":"<h5>U.S. Cross-Sector Threat Summary</h5><p><b>Supply-chain package poisoning</b> is the dominant cross-sector risk this week. Attacks republishing malicious package versions across npm, PyPI, and Composer ecosystems deliver credential stealers affecting government contractors, fintech build pipelines, and MSSP-managed developer environments simultaneously. Legitimate tooling abuse (RMM tools, developer extensions) used as persistence vector across all sectors.</p>"}]}}(function(){var data={};try{var raw=document.getElementById('artefacts-data');if(raw)data=JSON.parse(raw.textContent);}catch(e){}function open(key){var m=data[key];if(!m)return;var bd=document.getElementById('am-backdrop');var wt=document.getElementById('am-window-eyebrow');var wh=document.getElementById('am-window-title');var wb=document.getElementById('am-window-body');if(wt)wt.textContent=m.eyebrow||'';if(wh)wh.textContent=m.title||'';var metaHtml='';if(m.meta){metaHtml='<div class="am-meta">';for(var k in m.meta){metaHtml+='<div><div class="l">'+k+'</div><div class="v">'+m.meta[k]+'</div></div>';}metaHtml+='</div>';}var bodyHtml='';if(m.summary)bodyHtml+='<p>'+m.summary+'</p>';if(m.batches){m.batches.forEach(function(b,i){if(i>0)bodyHtml+='<div class="am-section-divider"><span class="am-section-tag">'+b.tag+'</span></div>';if(b.title)bodyHtml+='<h5>'+b.title+'</h5>';if(b.source)bodyHtml+='<p class="ws-meta-note">Source file: '+b.source+'</p>';bodyHtml+=b.content||'';});}if(wb)wb.innerHTML=metaHtml+bodyHtml;if(bd)bd.classList.add('is-open');document.body.style.overflow='hidden';}function close(){var bd=document.getElementById('am-backdrop');if(bd)bd.classList.remove('is-open');document.body.style.overflow='';}document.addEventListener('click',function(e){var t=e.target.closest('[data-artefact]');if(t){e.preventDefault();open(t.dataset.artefact);return;}var c=e.target.closest('#am-backdrop');if(c&&!e.target.closest('.am-window'))close();});var cb=document.getElementById('am-close-btn');if(cb)cb.addEventListener('click',close);document.addEventListener('keydown',function(e){if(e.key==='Escape')close();});})();
Protos AI automates CTI investigations using agentic AI — from OSINT collection to structured analysis. Speak to our team to see it in action.
Make sense of the upstream signals where adversaries hide — before the breach, not after.
.png)
