GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials
GhostAction compromised 500-plus GitHub accounts and planted workflows that steal cloud and AI API credentials.
8
Stories per day · 30 days
2 RSS
12 stories, newest first · one card per story
Stories tagged #socket
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Sixteen malicious Firefox extensions impersonating Rabby and OKX wallets stole recovery phrases via Cloudflare Workers.
7
12 Best SCA Tools Compared (2026): Features & Pricing
A 2026 SCA comparison highlights Snyk, Sonatype, and Socket across three dependency-risk lanes.
9
GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Two compromised GitHub Actions stayed live for nine days still serving the Mini Shai-Hulud payload.
2
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Re-enabled GitHub Actions again executed Mini Shai-Hulud payloads that stole CI/CD credentials.
2
Malicious Firefox Extension Disguised as PDF Tool Steals Google Account Sessions
A Firefox PDF add-on fetches post-install instructions that steal Google sessions and can silently reset passwords.
2
Twitch extension with 30K installs exposes users’ OAuth tokens
Twitch extension with 30,000+ installs exfiltrates users' OAuth session tokens to Russian-run JeetBot proxy servers.
1
Malicious Twitch Extension Exposes 31,000 Users' OAuth Tokens
Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' forwarded live OAuth session tokens of roughly 31,000 users to Russian JeetBot proxy servers.
1
Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems
Researchers link a May campaign that uploaded 2,000+ malicious RubyGems packages to OpenAI agents, which OpenAI calls benign training activity.
USN-8675-2: Perl vulnerabilities
Ubuntu issued USN-8675-2 fixing two Perl flaws (CVE-2026-12087, CVE-2026-13221) enabling information disclosure and regex-based security bypass on 26.04 LTS.
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.
6
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.
2