🕵🏻‍♂️ [InfoSec MASHUP] 20/2026 - The Platform Is the Attack Surface.The supply chain attack story this week isn't about ...

🕵🏻‍♂️ [InfoSec MASHUP] 20/2026 - The Platform Is the Attack Surface.The supply chain attack story this week isn't about a sketchy package lurking in a dark corner of npm. It's about #Anthropic Claude.ai shared chats being used to distribute Mac #malware, a fake Hugging Face repository impersonating OpenAI's Privacy Filter trending at #1 with 244,000 downloads, and JDownloader's own website serving swapped installers. The common thread isn't sophistication — it's borrowed credibility. Attackers have figured out that the detection model most users rely on, implicitly or otherwise, is "I've heard of this platform, therefore this thing on it is probably fine."That assumption has always been fragile. What's changed is how systematically it's being exploited. A trending repo with a quarter-million downloads looks legitimate by every surface signal. A shared Claude.ai chat looks like a helpful resource. A download from the official project website looks like the official project. The trust is...