A Fake AWS Terraform Provider Was Smuggling Malware Inside .woff Font Files
A trojanized Terraform provider hid malware inside .woff font files and executed the moment Terraform loaded it. Here is how the campaign worked and what is worth checking in your own provider and CI/CD setup.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.