GhostAction Targets GitHub Repositories for Credentials
Malicious workflows in 30,000+ GitHub repositories steal AWS, AI, and other keys by scanning commit history.
2
Stories per day · 30 days
605 RSS
Relatedsupply-chain8binance4cybercrime4espionage4hackmageddon4initial-access4phishing4social-engineering4android2arch-linux2aur2c22crypto2cursor2extension2gorbag2infostealer2lazarus2
13,652 stories, newest first · one card per story
Stories tagged #malware
Hospital gave doctor special PC for personal use after malware outbreak
Hospital ignored doctor's malware from adult content and provided a special PC for personal use, later leading to a lawsuit.
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware
CISA added CVE-2024-27834 to its KEV catalog after APT29 exploited it in a zero-click chain to deliver browser data-stealing malware to FCEB agencies.
Hackmageddon counts 438 confirmed incidents in October 2026
Malware led named vectors with 71 cases, and 98 breaches began at public-facing applications.
Scammers capitalize on GTA 6 hype to push malware and crypto cons
Scammers offer fake GTA 6 early access and mobile versions for crypto payments or malware before the November 19 launch.
Multiple phishing malware threats target US enterprises
SkyW4lker and GeorgeGinx phishing kits exploit Microsoft device code auth while WKLP infostealer targets government networks in US and France.
MEvince Knowledge-Constrained Framework Identifies Malware ATT&CK Techniques
MEvince uses shared behavioral representations and evidence-aligned retrieval to improve exact-ID F1 by 17.4% on 610 malware reports.
SlippyNunchucks hijacks Sogou Input Method to deploy DarkVigil malware
The SlippyNunchucks threat actor hijacked the Sogou Input Method branded vocabulary promotion mechanism to deploy DarkVigil implants targeting Chinese-speaking users in Asia and Europe.
Binance Hackers Used Fake Interviews to Steal Record-Breaking Cryptocurrency
Attackers stole 233.46 million XRP, 970,500 SOL and 44.2 million OP from Binance hot wallets using compromised engineer credentials.
1
North Korean hackers used fake job interview to breach Binance
Binance engineer downloaded malware during fake job interview, enabling $6.3B theft via social engineering and AI tooling.
3
Binance loses $6.3 billion in fake job interview malware attack
North Korean hackers used fake job interviews to install custom malware and steal $6.34 billion from Binance's wallet infrastructure.
1
Binance hackers used fake job interviews and AI tools to steal $6.3B
Attackers stole $6.34 billion from Binance using fake developer tool installations and job interview lures that delivered malware into AI tools; 98% of funds replenished.
Russian authorities dismantle VasyGrek cybercrime group
Police arrested three suspects from VasyGrek, a Russian-speaking hacking group active since 2016, in a rare public crackdown.
1
SkyW4lker phishing kit abuses Microsoft device-code authentication
SkyW4lker, GeorgeGinx and Mir0Auth compromise Microsoft 365 accounts via legitimate device-code flows in October 2026.
3
Russia-Aligned Gorbag Hackers Use WinRAR Flaw for Data-Stealing Malware
Gorbag deploys BeautyStealer after exploiting a now-patched WinRAR flaw in attacks on Ukrainian targets.
Gorbag APT group targets Ukrainian organizations with self-deleting malware
Gorbag APT uses BeautyStealer that erases itself after collecting credentials from Ukrainian law enforcement, city councils and defense entities.
Google shuts down XCPE botnet on Android devices
Google dismantled the XCPE botnet infecting over 1.3 million Android devices sold by Videostrong after it evaded security checks.
Cursor removes malicious Claude Code extension after SSH backdoor attempt
A malicious version of the Claude Code extension distributed through the Cursor marketplace for 11 hours installed SSH backdoors on developer machines.
Cursor Marketplace Hosts Malicious Claude Code Extension
Versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension were maliciously published for 11 hours targeting macOS and Windows users.
1
Survey Organizes Malware Clustering Techniques
Survey organizes prior malware clustering research into seven categories and highlights AI-driven methods for large-scale reproducible analysis.
EMBER2024 models cannot estimate executable first-seen dates
Machine learning on EMBER2024 features or raw bytes cannot replace external first-seen metadata for malware evaluation splits.
GMO tells customers to disconnect PCs after breach and ransomware threat
The company said up to 26,739 servers were at risk after malware was found on some customer environments.
Security Affairs malware newsletter round 120 published
The captured page shows only a cookie notice, so no malware items or findings can be summarized.
VMSpec recovers program semantics from virtual-machine-obfuscated code
A prototype stripped VM obfuscation from nearly all of 147 benchmark programs and six malware domain-generation algorithms.