GitHub issues used in CI attacks on 61 public repositories
Radware counted 83 payloads, mostly within 43 minutes on September 1, aimed at stealing CI secrets; code changes remain unconfirmed.
68
Product
GitHub
- Mentions · 7d3
- Mentions · 30d31
- All mentions51
- First seenAug 17, 2026
- Last mentioned1d ago
Timeline
51 articles · newest firstMalware planted in 42 GitHub repos targets Claude, Gemini and Cursor
Hooks in .github/init.js run at session start; JFrog links the traps to the testmetest npm campaign.
76
testmetest npm campaign hijacks 42 GitHub repositories to steal credentials
JFrog links the worm to hidden CI publishers on short-lived branches; disabling install scripts does not stop a newer import-triggered path.
74
Lazarus uses ML-KEM to deliver malware in FlashHole attacks
Kaspersky says phishing led to in-memory loaders and the Cubridge backdoor at South Korean firms, starting in July 2025.
74
OVHcloud CLI GitHub releases briefly served a secret-stealing binary
Compromised builds v0.11.0 through v0.15.0 were online for 94 minutes on October 19 before OVHcloud blocked them.
74
GhostAction plants font-disguised stealer in 94 GitHub repositories
Phishing via my-github.com steals GitHub passwords, 2FA, and OAuth tokens, then a VS Code task runs a credential stealer.
64
GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories
GhostAction hid credential-stealing Node.js malware in fake font files across 94 GitHub repositories.
76
Lessons learned building Fronteira, an MCP proxy with behavioral guardrails
Fronteira, an MCP proxy, turns natural-language rules into checks against cross-tool agent data leaks.
42
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Kazakhstan-linked Silent Lynx spies on Russia's Orsk refinery and regional governments using spear-phishing and lightweight malware.
76
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
58
Critical ChatGPT GitHub Connector Flaw Could Allow Attackers to Steal Private Repository Secrets
Researcher says ChatGPT’s GitHub connector can be prompt-injected into stealing private repository secrets.
62
Suspected Kazakhstan-linked hackers target governments across former Soviet states
Suspected Kazakhstan-linked UAT-6275 ran at least eight espionage campaigns against former Soviet governments since 2025.
76
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction compromised about 1,900 GitHub accounts and pushed malicious workflows to steal CI secrets from tens of thousands of repositories.
82
TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
76
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
About 1,000 of 1,280 AI-embedded products bypass SSO, so inherited agents escape identity governance.
45
DarkBlinders Hackers Use Fake Meeting App to Deploy Backdoor and Steal Government Data
DarkBlinders used a fake StarkMeet app and GitHub to backdoor systems and steal Kurdistan government data.
72
FakeGit malware campaign returns with 17,610 malicious GitHub repos
FakeGit returned with 17,610 GitHub repositories distributing SmartLoader and the StealC infostealer.
78
How one bug bounty researcher chooses the features they investigate
GitHub profiles VIP bug bounty researcher @vaib25vicky and higher payouts for quality findings.
18
GitHub Incident with Git Operations, Pull Requests and Actions
GitHub reported a short outage degrading Git operations, pull requests, Actions, webhooks, and issues.
6
AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes
Malwarebytes says BlueKit PhaaS lets criminals launch brand-phishing sites and steal sessions in about ten minutes.
63
OpenAI dumps 372 AI-generated math proofs on GitHub, telling the academic world to keep up
OpenAI published 372 AI-generated math proofs on GitHub, including Lean formalizations and claimed progress on open problems.
67
The Credential Layer Is Expanding Faster Than Security Teams Can See It
GitGuardian says secrets sprawl is outpacing visibility as commits, agents, and leaked AI credentials multiply.
36
Over 543,000 valid credentials exposed in public GitHub repositories
Truffle Security found 543,699 still-valid credentials exposed in public GitHub repositories.
64
GitHub's new dashboard experience now the default
GitHub's redesigned dashboard is now the default, combining agent sessions, issues, and pull requests with Copilot actions.
18
Everyone's Packing Up
A blog essay says creators are leaving big platforms for smaller, self-hosted sites.
6
Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
ReversingLabs traces S1ngularity, Shai-Hulud, and TeamPCP campaigns that poisoned npm updates to steal developer and cloud credentials.
58
Security startup finds more than 13,000 internal company screenshots that AI agents uploaded publicly
Glow Security found AI agents publicly uploaded over 13,000 internal screenshots from 343 organizations, exposing credentials.
78
Researchers Find 543,699 Active Credentials Leaked in Public GitHub Repos
Truffle Security verified 543,699 credentials still active after exposure in public GitHub repositories.
78
500,000 Active Credentials Left Exposed on GitHub
Truffle Security found 543,699 still-active credentials exposed in public GitHub repositories, many years old.
68
Over 543,000 GitHub Credentials Remain Active After Being Publicly Exposed
Truffle Security found 543,699 still-valid credentials exposed in public GitHub code.
78
AI Agents Expose 13,000+ Developer Screenshots Across 900+ GitHub Repositories
AI coding agents published over 13,000 internal screenshots to public GitHub repos, exposing credentials and customer data.
76
Over 543,000 valid credentials exposed in public GitHub repositories
Truffle Security found 543,699 still-valid credentials exposed in public GitHub repositories.
74
AI models keep posting screenshots showing sensitive data from inside tech companies
Glow Security found over 13,000 corporate screenshots AI agents posted to public GitHub repos.
76
Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Lumma, RedLine, and Vidar steal cloud and developer credentials, enabling session hijacking that bypasses MFA.
62
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
64
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.
76
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Attackers stole 170 CrowdSec private GitHub repositories using an OAuth token taken in the TanStack npm supply-chain attack.
73
Researchers used Claude to hack OpenAI
Researchers used Claude to chain a libheif vulnerability in Discourse with an OpenAI SSO flaw, gaining access to an internal GitHub repository.
75
NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle espionage group used GhostContainer, BlueKeep exploitation, and DCSync attempts to compromise Russian organizations and target Active Directory controllers.
75
New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools
A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.
78
Related CVEs
by mentions- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- CVE-2025-808894%8.4WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2026-10493587%8.6Auth Bypass to Command Execution in Ivanti Connect Secure
Appears with
- GitHubvendor · 21
- GitHuborganization · 15
- Microsoftvendor · 9
- Googlevendor · 9
- OpenAIvendor · 6
- Truffle Securityorganization · 5
- Recorded Futureorganization · 5
- OpenAIorganization · 5
- npmproduct · 5
- GitLabproduct · 4
- Cisco Talosorganization · 4
- Codexproduct · 4
- GitHub Actionsproduct · 4
- UAT-6275threat actor · 4
- Google Cloudproduct · 3
- Cloudflarevendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.