Poisoned Pipeline / Platforms / Installer / update channel
Installer / update channel
25 mapped incident(s) that touched this platform or registry.
Rank Math PRO 3.0.123 downloads carried malware that plants a recreating backdoor
4 mapped techniques
MacSync via signed fake Claude Desktop installers on a lookalike download site
macOS softwareAI coding agentsInstaller / update channel
7 mapped techniques
Microsoft counterfeit-installer campaign — same-named archives regenerate server-side per download
Windows softwareCDN / web assetsInstaller / update channel
7 mapped techniques
Fake TradingView macOS installer via YouTube ad
macOS softwareInstaller / update channel
3 mapped techniques
DAEMON Tools signed installers backdoored (Apr–May 2026)
Windows softwareInstaller / update channel
4 mapped techniques
UNC7017 swapped AOMEI update config for minutes at a time
Windows softwareInstaller / update channel
7 mapped techniques
Fake corepack.org infostealer and proxyware
npmWindows softwareInstaller / update channel
4 mapped techniques
Notepad++ update-server hijack (Jun–Dec 2025)
Windows softwareInstaller / update channel
2 mapped techniques
Operation SignSight trojanized VGCA installers on a government CA's download site
Windows softwareInstaller / update channelCertificates / trust stores
2 mapped techniques
Operation StealthyTrident compromised Able Desktop's update server
Windows softwareInstaller / update channel
2 mapped techniques
GoldenSpy backdoor shipped inside bank-mandated tax software
Windows softwareInstaller / update channel
2 mapped techniques
fwupd dangling S3 bucket and CVE-2020-10759 signature-verification bypass
Linux distro / packagesInstaller / update channel
2 mapped techniques
Monero CLI binaries stole wallet seeds
Windows softwareInstaller / update channel
3 mapped techniques
PureScript installer dependencies were sabotaged
Windows softwareInstaller / update channel
1 mapped techniques
AppleJeus fake crypto trading apps carried malware from vendor-run sites
Windows softwaremacOS softwareInstaller / update channel
2 mapped techniques
Operation ShadowHammer (ASUS Live Update)
Windows softwareInstaller / update channel
5 mapped techniques
PEAR installer served Perl backdoor
Linux distro / packagesInstaller / update channel
3 mapped techniques
VestaCP installer leaked admin passwords
Windows softwareInstaller / update channel
1 mapped techniques
CCleaner 5.33 signed ShadowPad backdoor
Windows softwareDeveloper workstationInstaller / update channel
8 mapped techniques
NotPetya via M.E.Doc accounting-software updates
Windows softwareLinux distro / packagesInstaller / update channel
4 mapped techniques
HandBrake mirror delivered Proton RAT
macOS softwareInstaller / update channel
3 mapped techniques
FossHub served MBR-overwriting installers
Windows softwareInstaller / update channel
1 mapped techniques
Linux Mint downloads served backdoored ISO
Linux distro / packagesWindows softwareInstaller / update channel
3 mapped techniques
vsftpd distribution site served backdoor
Windows softwareInstaller / update channel
3 mapped techniques