Threat Brief — 2026-07-31 — Supply chains under siege

Two supply-chain attacks dominate today's intel: Arch Linux scrambled to halt malicious AUR package takeovers, and ad-tech firm Adform's compromised scripts silently stole cryptocurrency from site visitors. A suspected Chinese-speaking APT launched fresh campaigns against Central Asian governments with novel OctLurk and SilkLurk malware, while a previously undocumented HollowFrame loader surfaced in a spear-phishing attack on a law firm. CISA's updated SBOM guidance drew both praise and criticism for lacking real risk-management improvements.

Top items

• Arch Linux disables AUR package adoption amid malicious takeover flood — The Arch Linux project temporarily disabled the ability to adopt orphaned AUR packages after attackers weaponised the adoption mechanism to flood the repository with malware. This is a direct supply-chain risk for any organisation pulling packages from AUR; review and pin your Arch dependencies. (src: BleepingComputer)

• Adform ad-platform compromise delivers clipboard-hijacking crypto-stealing scripts — A supply-chain attack against online advertising firm Adform injected malicious scripts into third-party websites using its platform, replacing cryptocurrency wallet addresses copied to visitors' clipboards with attacker-controlled addresses. Any site serving Adform ads could have exposed visitors to silent wallet-address substitution. (src: BleepingComputer)

• Suspected Chinese-speaking APT targets Central Asian governments with OctLurk and SilkLurk — A threat actor assessed as Chinese-speaking launched attacks against government organisations across Central Asia (Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria) using two malware families tracked as OctLurk and SilkLurk. Organisations with interests or operations in the region should treat this as an active espionage threat. (src: The Hacker News)

• HollowFrame loader deploys Matryoshka backdoor in law-firm spear-phishing — Researchers disclosed a previously undocumented Go-based loader framework called HollowFrame and a Rust-based backdoor dubbed Matryoshka, used in a spear-phishing intrusion at a law firm. The Go/Rust toolchain makes detection harder for traditional signature-based tools; legal-sector organisations should review email-forwarding and attachment-handling controls. (src: The Hacker News)

• CISA's updated SBOM guidance draws mixed reviews — CISA released refreshed Minimum Elements for SBOMs with roughly two dozen field changes aimed at making them more comprehensive, but critics argue the framework still lacks real risk-management improvements. First reported 2026-07-29 via CISA; today's coverage adds analyst pushback on whether the changes move the needle. (src: Dark Reading)

Themes

Supply-chain trust erosion continues. Both the AUR and Adform incidents exploit trusted distribution channels — a community package repository and an ad network — to reach downstream victims at scale. The pattern echoes recent npm, GitHub, and PyPI supply-chain attacks, reinforcing that package/ad-platform provenance verification is now baseline hygiene, not optional.

Cross-language malware tooling. HollowFrame (Go) and Matryoshka (Rust) follow a broader trend of threat actors adopting compiled, memory-safe languages that complicate static analysis and reverse engineering. Security teams should ensure their sandbox and EDR stack supports Go and Rust binary analysis.