Search: “git”

4 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 28 Exploit / PoC 28 Threat actor 8 Ransomware 6 Malware 4 Data breach 2 Advisory 1 Industry 1 Research 1 Tools 1 AI safety & security 1

SeverityAll critical 45 high 29 medium 4 low 0 info 3

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.

Cyber Security NewsSep 9, 14:07 UTC · 7d agoMalware in the wild

Most wanted malware in January 2019: A new threat speaks up

Help Net SecurityFeb 14, 00:00 UTC · Feb 14, 2019Malware in the wildCVE-2017-7269 CVE-2014-0160 CVE-2014-0346

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.

GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.

The Hacker NewsSep 3, 10:36 UTC · 13d agoMalware in the wild1

Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats

The Hacker NewsJun 26, 07:08 UTC · Jun 26, 2026Malware in the wild1