Aikido (Organization): news timeline & CVEs

Exposed GitLab project email addresses let attackers push code

Aikido warns published GitLab incoming-email tokens can let outsiders open merge requests and push code as the owner.

Aikido found private GitLab addresses for the "Email work item to this project" feature published in READMEs, contributing guides, and support pages. Each address embeds a long-lived glimt- token, and changing the suffix from issue to merge-request can open a merge request as the token owner without GitLab checking the sender address. Resulting access follows that user's permissions and may include code changes, CI/CD runs, private repositories, and secrets; IP restrictions are also bypassed. GitLab initially closed Aikido's May HackerOne report as intended behavior, then updated its interface and documentation. Exposed tokens should be reset.

BleepingComputerupdated Sep 25, 15:05 UTC · 1d agofirst Sep 24, 17:47 UTC · 2d agoVulnerability 6 sources1

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.

Aikido said Go malware was distributed through HashiCorp Registry Terraform providers gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads), plus Go modules gocommunity.io/orderedbtree and gogets.dev/btreex. The payloads overlap Graphalgo, a campaign ReversingLabs attributed to North Korean operators that approaches developers with fake Web3 jobs and malicious dependencies. The Go implant checks in over Slack, polls an Ethereum contract on Arbitrum Sepolia, collects system details, and can execute Go or JavaScript commands. Researchers also flagged related npm packages, and SentinelOne separately described TraderTraitor using weaponized Terraform lock files.

The Hacker NewsSep 23, 18:06 UTC · 3d agoMalware in the wild 4 sources

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer, using stolen GitHub Actions tokens for distribution.

A supply chain attack has compromised legitimate MemTensor packages on npm and PyPI to distribute a Go-based credential stealer named 'sckit'. The malicious packages target Windows, Linux, and macOS, stealing credentials from cloud services (AWS, GCP), source code platforms (GitHub, GitLab), package registries, and developer tools. The attacker gained publish tokens by exploiting MemTensor's GitHub Actions pipelines. The implant exfiltrates data to an external server and can self-propagate through GitHub and package publishing.

The Hacker Newsupdated Sep 23, 18:06 UTC · 3d agofirst Sep 23, 13:52 UTC · 3d agoMalware in the wild 4 sources1

Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT

Graphalgo malware expands supply-chain attacks to Terraform providers and Go modules, using Slack and blockchain for C2.

The Graphalgo malware campaign has expanded its supply-chain attack vector beyond npm and PyPI to include malicious Terraform providers and Go modules. This marks the first observed case of malware distribution through Terraform providers, directly targeting infrastructure-as-code workflows. The malware deploys a Go-based RAT that uses Slack API and Arbitrum Sepolia testnet blockchain for command-and-control, with activation gated by cryptographic hashes to target specific victims.

GBHackersupdated Sep 23, 18:06 UTC · 3d agofirst Sep 23, 10:00 UTC · 3d agoMalware in the wild 4 sources

The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths

Malware campaign distributes remote access tools via malicious Terraform providers and Go packages, using Slack and Ethereum smart contracts for command and control.

A malicious campaign linked to the threat actor Graphalgo has been discovered distributing remote access malware via compromised Terraform providers and Go software packages. The malicious packages, which included a typosquatted Terraform provider, used complex activation triggers to hide their payloads and avoid detection. Once activated, the malware collected system information and communicated with command and control servers via Slack and Ethereum smart contract transactions. Researchers at Aikido identified the campaign and noted it represents the first observed malware distribution through Terraform providers.

Cyber Security Newsupdated Sep 23, 18:06 UTC · 3d agofirst Sep 23, 09:22 UTC · 3d agoMalware in the wild 4 sources

Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories

CrowdSec says TeamPCP cloned about 170 repositories using a GitHub token stolen in the TanStack npm compromise.

CrowdSec said attackers linked to the May TanStack npm compromise, attributed to TeamPCP (UNC6780), used a stolen GitHub OAuth token from a former employee's lingering account to clone about 170 repositories, including private source. On May 11 the group backdoored 42 TanStack packages with Shai Hulud credential-harvesting malware; the clones occurred on May 22 and were publicly disclosed on September 16. Exposed material included console and detection code, emails for 83 users, 2020 investor contacts, and one restricted AWS SNS credential that an actor tested on August 17. CrowdSec said production infrastructure, customer databases, CI/CD pipelines, and open-source code were not altered.

GBHackersupdated Sep 22, 17:32 UTC · 4d agofirst Sep 21, 05:18 UTC · 6d agoData breach in the wild 3 sources

Aikido

Timeline6 articles

Appears with