Axios Supply Chain Fallout: Agentic AI Risk, IronPlate's Builder Breakdown, and What Stays Exposed After Remediation

Analysis

IronPlate Connects the Axios RAT Directly to Agentic AI Attack Surface

The most underreported angle on the Axios compromise: AI coding agents like Claude Code and Cursor running npm install autonomously would have deployed the RAT with zero human approval. If your dev environment has active MCP connections, a compromised workstation potentially reaches every system those MCPs touch.

The IE8 User-Agent String Hardcoded Across All Three RAT Platforms Is Your Easiest Detection Win

Elastic's teardown confirms that the anachronistic IE8/Windows XP user-agent is identical across the macOS, Windows, and Linux RAT variants, making it trivially detectable in network logs especially when it appears on a macOS or Linux host. If you have not already added this string to your SIEM rules, do it today.

SANS Flags TeamPCP as Probable Initial Access Broker Behind the Axios Hit

SANS analysts connect Axios to the broader TeamPCP campaign that hit Trivy, KICS, LiteLLM, and Telnyx in rapid succession during March 2026, and raises the possibility that TeamPCP is operating as an IAB selling access from stolen publishing credentials. That framing matters because it means the next target is not predictable and the window between compromise and exploitation is measured in hours.

Tools

Snyk's Axios Breakdown Adds Two More Compromised Packages to the Blast Radius

Beyond the main axios versions, Snyk flagged @qqbrowser/openclaw-qbot and @shadanai/openclaw as shipping the same malicious plain-crypto-js dependency, suggesting the attack infrastructure was being reused across coordinated campaigns. Their step-by-step lockfile audit commands are the most actionable thing you can hand a developer right now.

News

Microsoft Confirms Sapphire Sleet Used Hostwinds VPS Infrastructure for Axios C2

The C2 IP 142.11.206.73 ties directly to Hostwinds, a VPS provider Microsoft says Sapphire Sleet routinely uses for command and control, giving defenders a broader infrastructure pattern to block beyond just this campaign's specific domain. The registry run key persistence on Windows survives a RAT kill command, so a clean kill does not equal a clean machine.