A Self-Propagating npm Worm That Rotates C2 Through Ethereum, and a Hotel Portal That Borrows Your MFA

Four attacks that got past controls doing exactly what they were designed to do: valid signatures, real MFA, stolen sessions, and the Snowflake plea.