Researcher Breaches Systems of Over 35 Companies, Including Apple, Microsoft, and PayPal

A security researcher was able to breach the internal systems of over 35 major companies, including Apple, Microsoft, and PayPal, using a software supply chain attack (via Bleeping Computer).

paypal hack

Security researcher Alex Birsan was able to exploit a unique design flaw in some open-source ecosystems called "dependency confusion" to attack the systems of companies such as Apple, Microsoft, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber.

The attack involved uploading malware to open source repositories including PyPI, npm, and RubyGems, which were then automatically distributed downstream into the various companies' internal applications. Victims automatically received the malicious packages, with no social engineering or trojans required.

Birsan was able to create counterfeit projects using the same names on open-source repositories, each containing a disclaimer message, and found that applications would automatically pull public dependency packages, without needing any action from the developer. In some cases, such as with PyPI packages, any package with a higher version would be prioritized regardless of wherever it was located. This enabled Birsan to successfully attack the software supply chain of multiple companies.

Upon verifying that his component had successfully infiltrated the corporate network, Birsan reported his findings to the company in question, and some rewarded him with a bug bounty. Microsoft awarded him its highest bug bounty amount of $40,000 and released a white paper on this security issue, while Apple told BleepingComputer that Birsan will receive a reward via the Apple Security Bounty program for responsibly disclosing the issue. Birsan has now earned over $130,000 through bug bounty programs and pre-approved penetration testing arrangements.

A full explanation of the methodology behind the attack is available at Alex Birsan's Medium page.

Popular Stories

iPhone 17 Pro Blue Feature Tighter Crop

iPhone 17 Pro Launching in Three Months With These 12 New Features

Saturday June 21, 2025 2:45 pm PDT by
The iPhone 17 Pro and iPhone 17 Pro Max are around three months away, and there are plenty of rumors about the devices from credible sources. Below, we recap key changes rumored for the iPhone 17 Pro models as of June 2025:Aluminum frame: iPhone 17 Pro models are rumored to have an aluminum frame, whereas the iPhone 15 Pro and iPhone 16 Pro models have a titanium frame, and the iPhone X...
iPhone 16 Battery Life Feature

iOS 26's New Battery Life Mode Available Only on These iPhone Models

Saturday June 21, 2025 9:02 am PDT by
Last week, we reported that iOS 26 introduces an opt-in Adaptive Power Mode on the iPhone, alongside the existing Low Power Mode. Apple says that Adaptive Power Mode can make "small performance adjustments" when necessary to extend an iPhone's battery life, including slightly lowering the display brightness or allowing some activities to "take a little longer." The full description of...
All Screen iPhone 2027 Feature 1

iPhone Reportedly Moving to All-Screen Design in Two Stages

Sunday June 22, 2025 3:58 pm PDT by
Apple has long been working towards an iPhone with an all-screen design, and it might finally achieve the feat in a few more years from now. In his Power On newsletter today, Bloomberg's Mark Gurman said that Apple will shrink the size of the Dynamic Island on new iPhone models released next year. A year after that, he expects Apple to release a redesigned 20th-anniversary iPhone model....
iPhone 17 Pro Blue Feature Tighter Crop

iPhone 17 Pro's Alleged Vapor Chamber Cooling System Partly Revealed

Sunday June 22, 2025 6:37 am PDT by
Apple's upcoming iPhone 17 Pro and iPhone 17 Pro Max models are rumored to be equipped with a vapor chamber cooling system, and a leaker known as Majin Bu today shared a photo of an alleged copper thermal plate for the system. Many high-end Android smartphones like Samsung's Galaxy S25 Ultra are equipped with a vapor chamber cooling system, which can manage heat dissipation inside the...
ios 26 control center b2

iOS 26 Beta 2 Fixes Control Center Design

Monday June 23, 2025 10:58 am PDT by
With the second beta of iOS 26 that Apple provided to developers today, Apple addressed one of the major complaints that people have had with Liquid Glass. iOS 26 beta 1 on left, iOS 26 beta 2 on right The Control Center buttons are now slightly more opaque, making it easier to see the different control options even on a multicolored background. The new, more opaque look is apparent with the ...
Wi Fi WiFi General Feature

iOS 26 Adding Two New Wi-Fi Features, Allows AirDrop and AirPlay Alternatives

Saturday June 21, 2025 7:02 am PDT by
iOS 26 is gaining two new Wi-Fi features, including Captive Assist and Wi-Fi Aware. MacRumors contributor Aaron Perris discovered a reference to Captive Assist within the code for the first iOS 26 developer beta, but Apple has yet to enable the feature. It should be available by the time the software update is released later this year. In his Power On newsletter last month, Bloomberg's...
iOS 26 Feature

Everything New in iOS 26 Beta 2

Monday June 23, 2025 2:57 pm PDT by
Apple provided developers with the second beta of iOS 26, introducing the first changes and refinements to the new operating system since it debuted after the WWDC keynote. Because we're early in the beta testing process, there are quite a few tweaks to iOS 26, which we've rounded up below. Control Center The background behind the Liquid Glass Control Center buttons has more blur, allowing...
iOS 26 on Three iPhones

iOS 26 Includes These Five Smaller Features You Might Have Missed

Saturday June 21, 2025 11:18 am PDT by
While the dust is beginning to settle on the first iOS 26 beta, we continue to take a closer look at new features coming with the update. Below, we recap five smaller changes that you might have missed. Emoji Game Apple News+ subscribers in the U.S. and Canada can play a new Emoji Game, which tasks players with completing words and phrases with emoji. This is the fifth game that is...
airpods 4 blue

Apple Offering Free AirPods — Here's How to Get Them

Tuesday June 17, 2025 6:33 am PDT by
Apple is running a new promotion that offers free AirPods to qualifying customers. Now through September 30, college and university students in the U.S., Canada, Mexico, and Singapore can receive free AirPods 4 when they purchase an eligible new Mac or iPad from Apple. AirPods Pro 2 are also available at a discount. If you do not want AirPods, the promotion also offers various other...

Top Rated Comments

hybrid_x Avatar
57 months ago
I love that ethical hackers can actually earn a decent income through bug bounty programs.
Score: 27 Votes (Like | Disagree)
icanhazmac Avatar
57 months ago
Well played sir, well played!

I'm glad companies have bounty programs to encourage the "good guys" to report vulnerabilities. I have no idea how much time he put into the exploit but 130k is a nice payday.
Score: 16 Votes (Like | Disagree)
Stephen.R Avatar
57 months ago

People put too much trust in open-source community and software and this is the price they pay.
the irony of your statement is superb.

if the packages he spoofed had been open source he wouldn’t have been able to pull it off - it worked specifically because the companies were referencing internal/private packages (thus not open source) and he was able to make fake packages with the same name, in open source package repositories.

This type of shenanigans is just another reason why you should always vendor your dependencies kids.
Score: 12 Votes (Like | Disagree)
Kabeyun Avatar
57 months ago
This reminds me of the Russians hacking SolarWinds. Don’t get to the companies, get to the software the companies use and trust. Of course the irony is that these companies are some of the same ones that have been spending years trying to teach us not to automatically trust downloaded software.
Score: 11 Votes (Like | Disagree)
Blackstick Avatar
57 months ago
Well, time to hire this guy...
Score: 9 Votes (Like | Disagree)
BootsWalking Avatar
57 months ago

People put too much trust in open-source community and software and this is the price they pay.

Open-source software, unless independently audited, have no guarantees of being secure (or even functional). Remember the disclaimer “this software is provided ‘AS IS’...”

They might even contain malicious code, since very few people will actually read the code before executing it.
The issue isn't open source - it's in the distribution model of software dependencies. This vulnerability has been known for quite some time.
Score: 7 Votes (Like | Disagree)