Socket (Organization): news timeline & CVEs

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

Two compromised GitHub Actions stayed live for nine days still serving the Mini Shai-Hulud payload.

Socket found that GitHub Actions actions-cool/issues-helper and actions-cool/maintain-one-comment, removed after a May 18 Mini Shai-Hulud compromise, were accessible again from September 16 to September 25, 2026, with release tags still pointing at the malicious commit. Workflows that referenced those tags downloaded and executed an obfuscated payload in index.js that targets developer tokens, credentials, and CI/CD secrets. The May campaign infected 323 npm packages and 639 versions. GitHub lists about 15,000 repositories depending on issues-helper, though not all pin mutable tags. Both actions were disabled again on September 25; Socket advises removing or pinning a clean commit, reviewing runs since September 16, and rotating exposed secrets.

BleepingComputerSep 26, 14:19 UTC · 18h agoMalware in the wild 2 sources

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Re-enabled GitHub Actions again executed Mini Shai-Hulud payloads that stole CI/CD credentials.

Socket reports that actions-cool/issues-helper and actions-cool/maintain-one-comment, compromised on May 18, 2026 in the Mini Shai-Hulud campaign, became accessible again on September 16. Their release tags still pointed at malicious content, so workflows referencing those tags resumed downloading a payload that harvested CI/CD credentials and exfiltrated them to an attacker-controlled server tied to t.m-kosche[.]com. GitHub Staff has disabled both repositories again. Workflows pinned to a full commit SHA from before May 18 were not affected; Socket advises removing the actions, rotating secrets, and reviewing runs after September 16.

The Hacker Newsupdated Sep 26, 14:19 UTC · 18h agofirst Sep 25, 14:44 UTC · 1d agoMalware in the wild 2 sources

Malicious Firefox Extension Disguised as PDF Tool Steals Google Account Sessions

A Firefox PDF add-on fetches post-install instructions that steal Google sessions and can silently reset passwords.

Socket identified a Firefox add-on, PDF Identity Verifier (pdf-para-texto@extensao.local), listed on September 3, 2026, that became malicious in version 1.4 on September 11. After installation it loads attacker-supplied settings, monitors Google traffic, exfiltrates session cookies, and can submit a new password when Google requires a reset, hidden by a full-screen overlay. The lure mainly targets Portuguese- and Spanish-speaking users with a protected-PDF pretext. Socket reported a small user base and assessed overall impact as fairly low.

Cyber Security NewsSep 24, 07:15 UTC · 3d agoMalware in the wild 2 sources

Fake Firefox Extension Hijacks Google Accounts Without Stealing Passwords First

A fake Firefox PDF extension steals Google oauth_token cookies and automates account takeover after install.

Socket found a Firefox add-on posing as a PDF identity-verification tool that looks benign in static review, then loads attacker configuration from pdf.gusercontent.com after install. Published on September 3, 2026, it gained malicious behavior in version 1.4 on September 11. It captures Google Set-Cookie values containing oauth_token and can inject automation into accounts.google.com to drive recovery flows and set a new password. Immediate impact is assessed as low because the extension has no substantial user base; lures support Portuguese, Spanish, and English.

GBHackersupdated Sep 24, 07:15 UTC · 3d agofirst Sep 24, 05:15 UTC · 3d agoMalware in the wild 2 sources

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.

Aikido said Go malware was distributed through HashiCorp Registry Terraform providers gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads), plus Go modules gocommunity.io/orderedbtree and gogets.dev/btreex. The payloads overlap Graphalgo, a campaign ReversingLabs attributed to North Korean operators that approaches developers with fake Web3 jobs and malicious dependencies. The Go implant checks in over Slack, polls an Ethereum contract on Arbitrum Sepolia, collects system details, and can execute Go or JavaScript commands. Researchers also flagged related npm packages, and SentinelOne separately described TraderTraitor using weaponized Terraform lock files.

The Hacker NewsSep 23, 18:06 UTC · 3d agoMalware in the wild 4 sources

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer, using stolen GitHub Actions tokens for distribution.

A supply chain attack has compromised legitimate MemTensor packages on npm and PyPI to distribute a Go-based credential stealer named 'sckit'. The malicious packages target Windows, Linux, and macOS, stealing credentials from cloud services (AWS, GCP), source code platforms (GitHub, GitLab), package registries, and developer tools. The attacker gained publish tokens by exploiting MemTensor's GitHub Actions pipelines. The implant exfiltrates data to an external server and can self-propagate through GitHub and package publishing.

The Hacker Newsupdated Sep 23, 18:06 UTC · 3d agofirst Sep 23, 13:52 UTC · 3d agoMalware in the wild 4 sources1

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

Checkmarx details malicious npm package indexed-btree hiding its loader in runtime code, netting €230,000; Socket flags PolinRider Packagist compromise.

Checkmarx reports the malicious npm package indexed-btree, uploaded June 18, 2026 by user 'charlessadler25' and mimicking the legit sorted-btree library, hid its loader inside BTree.prototype.set() instead of lifecycle scripts, amassing millions of downloads and earning about €230,933 (109 ETH). The malware fingerprints hosts, beacons to a Slack channel and Telegram bot, and uses EtherHiding on a Sepolia smart contract to fetch staged encrypted payloads before deleting artifacts. Nine related packages were removed from npm. Separately, Socket detailed the North Korea-linked PolinRider campaign compromising the Packagist package visanduma/nova-two-factor via the LaHiRu developer account.

The Hacker Newsupdated Sep 24, 11:07 UTC · 2d agofirst Sep 22, 09:38 UTC · 4d agoMalware in the wild 8 sources

Socket

Timeline7 articles

Appears with