Product

GitHub Copilot

1 mentions in 7 days · 4 in 30 days · 4 total · first seen Aug 17, 2026 · last 6d ago

Timeline4 articles

Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs

Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.

Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.

GBHackersupdated Sep 9, 14:07 UTC · 6d agofirst Sep 9, 12:52 UTC · 6d agoThreat actor in the wild 2 sources1

Microsoft’s Project Zenith is a ‘distraction-free Windows experience’ for developers

Microsoft branded its developer-optimized Windows setup Project Zenith, with 64GB+ memory devices from AMD that run 30B+ parameter AI models locally.

Microsoft named its developer-focused Windows configuration Project Zenith, targeting new hardware with 64GB or more of unified memory. AMD unveiled the first Project Zenith device at IFA, a miniature PC powered by Ryzen AI Halo chips, with more devices expected in the coming months. The setup ships with a preconfigured Windows install and preinstalled developer tools including Visual Studio Code, GitHub Copilot, PowerToys, WinAppCLI, and Windows Dev Skills. Microsoft says it lets developers run 30B+ parameter models locally and unmetered, reducing reliance on metered cloud tokens.

The Verge · AISep 4, 10:44 UTC · 11d agoAI industry1

Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware

Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.

Kaspersky researchers documented two previously undocumented Node.js malware families, NodeRabbit and PollCat, attributed with high confidence to Iran-linked APT group Mirage Kitten. The malware is delivered via fake recruiter personas on LinkedIn offering coding assessments hosted on Amazon S3, with instructions banning AI assistants so AI code-review tools would not flag the trojanized npm packages. NodeRabbit is cross-platform (Windows, Linux, macOS), uses AES-256-GCM-encrypted C2 on Azure, includes sandbox checks, and one variant installs a fake 'GitHub Copilot Helper' VS Code extension plus Git hook persistence. Victims identified so far are in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan.

Security AffairsSep 2, 10:37 UTC · 13d agoThreat actor in the wild1

Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR

Wiz's autonomous Red Agent found and exploited a GitHub Actions injection in a Copilot-assisted PR, reaching Snowflake's internal Jira without human help.

Wiz's Red Agent autonomously discovered a GitHub Actions injection flaw in a GitHub Copilot-assisted pull request, five days after the flaw went live. It exploited the flaw to validate access to sensitive data in Snowflake's internal Jira, bypassing detection by GitHub Advanced Security, and assessed the blast radius without human intervention. The exercise demonstrates agentic AI performing end-to-end offensive security operations against production systems.

Wiz BlogAug 17, 14:00 UTC · 29d agoAI safety & security1

Appears with

vendor Microsoft 3 organization Microsoft 2 product Visual Studio Code 2 vendor GitHub 2 threat actor Mirage Kitten 2 vendor Kaspersky 2 product NodeRabbit 2 product PollCat 2 organization AMD 1 malware PollCat 1 threat actor Smoke Sandstorm 1 organization Snowflake 1 organization Wiz 1 product Amazon S3 1 organization Kaspersky 1 organization Google 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.