Alberta recall campaigners' cold, hard road to collect signatures to oust MLAs
Education Minister Demetrios Nicolaides' recall bid got 6,500 signatures, but was still far short of its goal. Other MLA recalls appear to be struggling even more than that.
#politics #campaign #Alberta
https://www.cbc.ca/news/canada/calgary/recall-yaseen-singh-nicolaides-smith-9.7053720?cmp=rss








![[ImageSource: Socket]
⁉️Another crucial anti-analysis control adopted by the threat actor relates to the use of honeypot form fields that are hidden from view for real users, but are likely to be populated by crawlers. This step acts as a second layer of defense, preventing the attack from proceeding further.⁉️
Socket said the domains packed into these packages overlap with adversary-in-the-middle [AitM] phishing infrastructure associated with Evilginx, an open-source phishing kit.
"This campaign follows the same core playbook, but with different delivery mechanics," Socket said. "Instead of shipping minimal redirect scripts, these packages deliver a self-contained, browser-executed phishing flow as an embedded HTML and JavaScript bundle that runs when loaded in a page context."
👾What's more, the phishing packages have been found to hard-code 25 email addresses tied to specific individuals, who work in account managers, sales and business development representatives in manufacturing, industrial automation, plastics and polymer supply chains, healthcare sectors in Austria, Belgium, Canada, France, Germany, Italy, Portugal, Spain, Sweden, Taiwan, Turkey, the U.K. and the U.S.👾](https://files.mastodon.social/cache/media_attachments/files/115/883/538/281/793/471/small/4a0f67a2aeac898d.jpeg)
![[ImageSource: Socket]
⚠️It's currently unknown how the attackers obtained the email addresses. But given that many of the targeted firms convene at major international trade shows, such as Interpack and K-Fair, it's suspected that the threat actors may have pulled the information from these sites and combined it with general open-web reconnaissance.⚠️
"In several cases, target locations differ from corporate headquarters, which is consistent with the threat actor's focus on regional sales staff, country managers, and local commercial teams rather than only corporate IT," the company said.
👾To counter the risk posed by the threat, it's essential to enforce stringent dependency verification, log unusual CDN requests from non-development contexts, enforce phishing-resistant multi-factor authentication [MFA], and monitor for suspicious post-authentication events.👾
⁉️The development comes as Socket said it observed a steady rise in destructive malware across npm, PyPI, NuGet Gallery, and Go module indexes using techniques like delayed execution and remotely-controlled kill switches to evade early detection and fetch executable code at runtime using standard tools such as wget and curl.⁉️
<https://socket.dev/blog/2025-report-destructive-malware-in-open-source-packages>](https://files.mastodon.social/cache/media_attachments/files/115/883/538/314/854/295/small/a47f8e0ac1bd7ec8.jpeg)



