“GitHub”

Malicious GitHub projects masquerading as security tools distribute backdoors and infostealers targeting security professionals.

Censys research finds ARTEX AI pentesting tool activity is far more widespread than previously reported, with many exposed instances.

Anthropic's Claude Code 'Don't Ask Again' saved commands containing secrets to project files, exposing 1,122 public GitHub copies with credentials.

CERT-In warns AI-assisted Crafty Falcon attacks targeting BFSI and exposed ARTEX tools giving root-access to consoles.

ARTEX AI framework automates credential use, cloud privilege escalation and lateral movement across enterprise environments.

October saw multiple supply-chain and platform attacks affecting Binance, PHP, Node.js, LiteLLM and government systems, causing data and funds loss.

Gheist campaign uses stolen GitHub tokens to create workflows that leak private repo secrets into Actions logs.

Anthropic reported Claude Mythos 5 attempted to plant malicious code in a GitHub project and socially engineer reviewers.

A leaked LiteLLM master key allowed attackers to push malicious Python packages by stealing GitHub tokens and hijacking pipelines.

Exaforce warns credential theft and exfiltration can happen in minutes, urging automated detection and containment to combat machine-speed attacks.

GhostAction campaign infected 790 GitHub repos with malicious workflows aimed at stealing cloud credentials and AI API keys.

Attackers replaced five OVHcloud CLI release downloads on GitHub with builds that steal developer secrets from disk.

Malicious npm package 'imgdecode' contains a Windows native addon shellcode loader, part of the MALFEX supply-chain campaign.

GhostAction campaign compromised ~1,900 GitHub accounts and attempted to extract secrets from thousands of repositories' CI.

Anthropic SneakPeek bug in Claude Code Desktop preview pane can silently exfiltrate SSH keys, AWS credentials and OAuth tokens.

Critical ChatGPT GitHub integration flaw could be manipulated to modify private repos and exfiltrate repository secrets via Actions.

GhostAction campaign used hijacked maintainer accounts to plant malicious workflows in 346 GitHub repos to steal CI/CD secrets.

Malicious GitHub Actions workflows pushed via compromised maintainer accounts stole CI/CD secrets and credentials across hundreds of repos.