Výsledky hledání

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

Executive Summary Following disclosure of the TraderTraitor attack against LayerZero in April 2026, SentinelOne identified an additional victim with the same macOS backdoors. Our analysis explores the mechanics of these backdoors and the expanded targeting against a victim in the IT services sector with no relationship to cryptocurrency trading. We also identified more weaponized GitHub repositories from the social engineering schemes used to target job seekers in these campaigns. This report…

Apple Terraform GitHub US

tg: incident tg: varování tg: rozbor tp: malware tp: phishing tp: dodavatelský řetězec tp: špionáž

18. 9. 19:00 · SentinelLabs · Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. [...]

GitHub LastPass US

tg: varování tp: malware

18. 9. 17:19 · BleepingComputer · Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

CVE-2026-81381 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

EPSS 0.01 CVE-2026-81381 GitHub US

tg: zranitelnost tp: AI tp: identita

8. 9. 16:00 · Microsoft Security · CVE-2026-81381 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

CVE-2026-81380 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

EPSS 0.01 CVE-2026-81380 GitHub US

tg: zranitelnost tp: AI

8. 9. 16:00 · Microsoft Security · CVE-2026-81380 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

Executive Summary Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond. In Q2 2026, GTIG observed threat actors compromise a cloud resource, then plan,…

PyPI npm Docker GitHub zdravotnictví veřejná správa média US

tg: varování tg: rozbor tp: malware tp: dodavatelský řetězec tp: AI tp: identita

8. 9. 14:30 · Mandiant / Google TI · GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

Risolte vulnerabilità su GitHub Enterprise Server

Rilasciati aggiornamenti di sicurezza che risolvono 4 nuove vulnerabilità, di cui 3 con gravità “alta”, in GitHub Enterprise Server.

EPSS 0.01 CVE-2026-18730 CVE-2026-19118 CVE-2026-76851 GitHub IT

tg: zranitelnost

2. 9. 11:20 · CSIRT Itálie (ACN) · Risolte vulnerabilità su GitHub Enterprise Server

CVE-2026-64654 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

Information published.

EPSS 0.01 CVE-2026-64654 GitHub US

11. 8. 10:18 · Microsoft Security · CVE-2026-64654 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

CVE-2026-64652 GitHub CLI: Partial token disclosure in `gh auth status` output

Information published.

EPSS 0.00 CVE-2026-64652 GitHub US

11. 8. 10:02 · Microsoft Security · CVE-2026-64652 GitHub CLI: Partial token disclosure in `gh auth status` output

CVE-2026-64653 GitHub CLI: Unescaped variable components in request URLs could allow path traversal

Information published.

EPSS 0.01 CVE-2026-64653 GitHub US

11. 8. 10:02 · Microsoft Security · CVE-2026-64653 GitHub CLI: Unescaped variable components in request URLs could allow path traversal

How legitimate cloud platforms enable phishers to bypass MFA

Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This post analyzes the mechanics of a real-life adversary-in-the-middle …

Cloudflare Vercel Netlify GitHub RU

4. 8. 14:00 · Securelist (Kaspersky) · How legitimate cloud platforms enable phishers to bypass MFA

CVE-2026-59831 GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace

Information published.

EPSS 0.00 CVE-2026-59831 GitHub US

15. 7. 10:02 · Microsoft Security · CVE-2026-59831 GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace

CVE-2026-41109 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

EPSS 0.01 CVE-2026-41109 GitHub US

14. 7. 16:00 · Microsoft Security · CVE-2026-41109 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

CVE-2026-47282 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

EPSS 0.01 CVE-2026-47282 GitHub US

14. 7. 16:00 · Microsoft Security · CVE-2026-47282 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Coordinated GitHub API Enumeration and Access Token Abuse (Campaign)

Datadog Security Labs identified multiple coordinated campaigns abusing the GitHub API to systematically enumerate organizations, repositories, users, and software development activity at scale. The activity primarily relied on legitimate GitHub functionality, including dorman...

GitHub Datadog US

8. 7. 02:00 · Wiz Research · Coordinated GitHub API Enumeration and Access Token Abuse (Campaign)

And another one. GitHub ships break-glass credential revocation

Break-glass credential revocation is live on GitHub Enterprise. The Trivy and Microsoft durabletask repeats show why fast, complete revocation was needed.. Category: News

GitHub Microsoft BE

1. 7. 06:06 · Aikido Security · And another one. GitHub ships break-glass credential revocation

GitBait: Phishing the Mexican Financial Sector

A modular phishing infrastructure targeting multiple Mexican banks has been uncovered, abusing GitHub-hosted Pages, employing obfuscated scripts, and featuring a centralized credential exfiltration via SheetBest API, indicating a scalable and persistent multi-brand phishing operation.

GitHub finance SG

17. 6. 08:57 · Group-IB · GitBait: Phishing the Mexican Financial Sector

CVE-2026-45482 Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

EPSS 0.00 CVE-2026-45482 Microsoft GitHub US

9. 6. 16:00 · Microsoft Security · CVE-2026-45482 Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability

5 Gitleaks alternatives and why they are better

Looking for a Gitleaks alternative? We compare Betterleaks, TruffleHog, Aikido, GitHub Advanced Security, and Spectral so you can find the best secrets scanner for your team. Category: DevSec Tools & Comparisons

Gitleaks TruffleHog GitHub BE

22. 5. 09:05 · Aikido Security · 5 Gitleaks alternatives and why they are better

Megalodon Campaign Backdoors GitHub Repositories via CI Workflow Compromise (Campaign)

Researchers disclosed a large-scale software supply chain campaign dubbed “Megalodon,” in which attackers reportedly compromised thousands of GitHub repositories by injecting malicious GitHub Actions workflows designed to exfiltrate secrets and cloud credentials. The campaign ...

GitHub US

22. 5. 02:00 · Wiz Research · Megalodon Campaign Backdoors GitHub Repositories via CI Workflow Compromise (Campaign)

GitHub breached via a malicious VS Code extension: why developer devices are the real target

GitHub confirmed a poisoned VS Code extension compromised an employee device, exposing 3,800 internal repos. Why developer workstations are now the top supply chain target. Category: Vulnerabilities & Threats

GitHub BE

20. 5. 11:06 · Aikido Security · GitHub breached via a malicious VS Code extension: why developer devices are the real target

TeamPCP Claims Breach of Internal GitHub Repositories (Incident)

According to GitHub’s public statement, the company detected unauthorized access involving internal repositories and initiated an ongoing investigation into the scope and potential impact of the incident. GitHub stated that it is closely monitoring its infrastructure for follo...

GitHub US

20. 5. 02:00 · Wiz Research · TeamPCP Claims Breach of Internal GitHub Repositories (Incident)

GitHub internal repositories breached

<p>A malicious VS Code extension led to cloned private repositories, reportedly offered for sale on a criminal forum</p>Categories: Threat ResearchTags: GitHub, Supply chain

GitHub GB

20. 5. 02:00 · Sophos Threat Research · GitHub internal repositories breached

New Mini-Shai-Hulud Wave Targets NPM, PyPi Packages and VSCode Extension (Campaign)

Researchers identified a broad TeamPCP-linked supply chain campaign involving malicious NPM packages, compromised GitHub Actions, a trojanized VSCode extension, and malicious PyPI packages targeting cloud and CI/CD environments. The campaign includes large-scale credential the...

GitHub US

18. 5. 02:00 · Wiz Research · New Mini-Shai-Hulud Wave Targets NPM, PyPi Packages and VSCode Extension (Campaign)

LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout

When a company suffers a cyber breach, its stock price often takes a hit, but the timing, depth, and duration of that reaction are far less predictable. In this LABScon25 presentation, Mick Baccio and Scott Roberts explore whether public indicators of breach activity can be used to anticipate market response before formal disclosure. Drawing on sources such as EDGAR filings, executive blog posts, and social media chatter, the speakers examine how public breadcrumbs can reveal incident activity…

SentinelOne Splunk GitHub Apple US

14. 5. 15:00 · SentinelLabs · LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout

The complete GitHub Actions security checklist

GitHub Actions misconfigurations have been behind some of the biggest supply chain attacks of 2025 and 2026. Here's what went wrong and how to prevent them from happening to your org. Category: Guides & Best Practices

GitHub BE

11. 5. 03:25 · Aikido Security · The complete GitHub Actions security checklist

CI/CD pipeline abuse: the problem no one is watching

Preamble In 2025 and 2026, we watched a pattern play out across the industry. Attackers stopped going after production servers directly and started targeting the automation that deploys to them. Compromised developer credentials, a modified workflow file, and suddenly every secret in a CI/CD environment is streaming to an attacker-controlled endpoint. We saw this play out across incidents involving major open-source projects, Fortune 500 companies, and critical infrastructure tooling. The…

GitHub GitLab Microsoft US

tg: rozbor tg: novinka v produktu tp: dodavatelský řetězec tp: AI tp: identita

29. 4. 02:00 · Elastic Security · CI/CD pipeline abuse: the problem no one is watching

Elementary Data Compromised in Supply Chain Attack (Campaign)

The compromise originated from a GitHub Actions script injection vulnerability in a workflow that improperly handled untrusted input from pull request comments. An attacker exploited this flaw to execute arbitrary commands within the CI pipeline, gaining access to the reposito...

GitHub US

23. 4. 02:00 · Wiz Research · Elementary Data Compromised in Supply Chain Attack (Campaign)

PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories (Campaign)

A supply chain campaign attributed to a DPRK-linked threat actor, PolinRider, has resulted in the compromise of over 1,900 GitHub repositories through malicious npm packages, VS Code artifacts, and injected JavaScript payloads. The campaign leverages stealthy code injection an...

GitHub npm US

9. 4. 02:00 · Wiz Research · PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories (Campaign)

Exploitation Campaign of Vulnerable GitHub Workflows (Campaign)

An unknown threat actor has been conducting an opportunistic campaign of automated malicious pull requests to attempt to initiate supply chain compromise against various open source repositories. In at least two cases, the attacker has been able to inject malicious code that u...

GitHub US

6. 4. 02:00 · Wiz Research · Exploitation Campaign of Vulnerable GitHub Workflows (Campaign)

xygeni-action repository hijack (Incident)

The compromise of the xygeni-action represents a CI/CD supply chain attack in which a threat actor leveraged tag poisoning to distribute a backdoored GitHub Action at scale. The attacker first gained access to the repository via compromised maintainer credentials and a GitHub ...

GitHub US

9. 3. 01:00 · Wiz Research · xygeni-action repository hijack (Incident)