From Wikipedia
Security teams are investigating a campaign launched via compromised third‑party accounts with unverified attribution.
