Hackers breach ISP to poison software updates with malware

Volexity reported that the Chinese APT StormBamboo compromised an ISP and abused insecure HTTP-based software update workflows and DNS poisoning to push backdoored installers (including MACMA and POCOSTICK/MGBot) to Windows and macOS victims; the attackers also installed a malicious Chrome extension (ReloadText) to steal cookies and mail data. The activity suggests a supply-chain or adversary-in-the-middle approach, with corroborating telemetry and prior related incidents observed by ESET and Symantec.