Tag: github
-
Claude Code’s >>Don’t Ask Again<< Feature Exposes 2,539 Secrets Across 1,994 GitHub Repositories
A newly identified 2,539 distinct secrets across 1,994 public GitHub repositories, tracing exposure to coding-agent configuration files, Git history, and saved transcripts. Their November 5 research describes how Claude Code’s “Yes, and don’t ask again” approval can persist credential-bearing shell commands inside .claude/settings.local.json. Exposed material included production database passwords, cloud credentials, API tokens, and SSH…
-
Claude Code’s >>Don’t Ask Again<< Feature Exposes 2,539 Secrets Across 1,994 GitHub Repositories
A newly identified 2,539 distinct secrets across 1,994 public GitHub repositories, tracing exposure to coding-agent configuration files, Git history, and saved transcripts. Their November 5 research describes how Claude Code’s “Yes, and don’t ask again” approval can persist credential-bearing shell commands inside .claude/settings.local.json. Exposed material included production database passwords, cloud credentials, API tokens, and SSH…
-
Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them.When a user selects “Yes, and don’t ask again,” Anthropic’s AI coding assistant can save the command, word-for-word, including the secret, in a project settings file.Software security company Apiiro said yesterday…
-
Hackers Use Fake GitHub Security Tools to Spread Malware, Infecting Over 2,000 Computers
Tags: access, backdoor, blockchain, computer, credentials, crypto, cyber, cybersecurity, github, hacker, malware, threat, toolThreat actors are distributing malware through GitHub repositories masquerading as security utilities, infecting more than 2,000 computers. According to Doctor Web’s November 5 investigation, the campaign targets cybersecurity professionals alongside blockchain gaming enthusiasts, weaponizing Visual Studio projects and Python and Go scripts to deploy remote access backdoors, cryptocurrency clippers, and credential stealers. The operation initially…
-
Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/
-
Hackers enlist Artex to scan GitHub repositories for exposed secrets
Agentic AI tools target downstream tenants using stolen credentials, according to Microsoft researchers. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/hackers-artex-github-repositories-exposed-secrets/874007/
-
Hackers Use ARTEX AI to Steal Azure Key Vault Secrets Just 5 Minutes After Finding Exposed GitHub Credentials
Attackers using the ARTEX agentic AI framework to discover exposed GitHub credentials and rapidly compromise cloud environments. In one intrusion, an AI agent progressed from searching GitHub for application secrets to exfiltrating Azure Key Vault data in just five minutes. The activity compresses a familiar attack chain: finding leaked credentials, validating access, mapping resources, and…
-
Hackers Use ARTEX AI to Steal Azure Key Vault Secrets Just 5 Minutes After Finding Exposed GitHub Credentials
Attackers using the ARTEX agentic AI framework to discover exposed GitHub credentials and rapidly compromise cloud environments. In one intrusion, an AI agent progressed from searching GitHub for application secrets to exfiltrating Azure Key Vault data in just five minutes. The activity compresses a familiar attack chain: finding leaked credentials, validating access, mapping resources, and…
-
Fake ChatGPT and Claude Apps Use Signed Executables to Install Yoba Malware
Fake ChatGPT and Claude apps spread Yoba malware through GitHub, using signed executables to load a cryptominer on… First seen on hackread.com Jump to article: hackread.com/fake-chatgpt-claude-apps-software-yoba-malware/
-
Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research published its findings on October 27, 2026, after about two months of tracking. The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading. The…
-
Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research published its findings on October 27, 2026, after about two months of tracking. The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading. The…
-
Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research published its findings on October 27, 2026, after about two months of tracking. The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading. The…
-
DarkBlinders APT Hackers Target Israel and Iraqi Kurdistan With StarkMeet Malware and GitHub-Based Backdoors
Tags: apt, backdoor, cloud, credentials, cyber, cyberespionage, github, government, hacker, iraq, malware, phishing, theftDarkBlinders has compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in Iraqi Kurdistan, combining credential phishing, a fake meeting application, and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026 and reported that it remained active at publication. Confirmed activity included credential theft and…
-
AI coding agents are installing MCP servers that will never be patched
When a developer tells an AI coding agent to >>set up a GitHub MCP,<< the agent has to pick a package. New research from Glow Labs documents sessions where it picked … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/
-
KI-Flaggschiffe als Köder Malware ‘Yoba” tarnt sich als ChatGPT- und Claude-App
Die Sicherheitsforscher von Check Point Research (CPR), der Forschungsabteilung von Check Point Software Technologies. haben eine Malware-Kampagne aufgedeckt, die gezielt das Interesse an bekannten KI-Tools ausnutzt. Unter dem Namen ‘Yoba” verbreiten Cyberkriminelle Schadsoftware über gefälschte Github-Projekte, die vermeintliche Desktop-Anwendungen von ChatGPT und Claude bewerben. Um ihre Downloads glaubwürdig wirken zu lassen, missbrauchen sie legitime, digital…
-
DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work
Deepseek released a research prototype of dsh-superagent, a coding agent that does work on a GitHub repository for you. Who can ask for work The agent gets to work in two … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/02/deepseek-dsh-superagent/
-
KI-Software braucht klare Bezugswege: Was Unternehmen aus Yoba lernen können
Bekannte KI-Marken, überzeugende GitHub-Projekte und echte digitale Signaturen: Die Yoba-Kampagne verbindet mehrere Vertrauenssignale zu einer Download-Falle. Für CIOs und CISOs steht damit nicht nur die Auswahl von KI-Diensten auf der Agenda, sondern auch die kontrollierte Bereitstellung ihrer Desktop-Anwendungen. Entscheidend sind geprüfte Bezugswege und die Kontrolle des ausgeführten Codes nicht allein das Logo oder die… First…
-
KI-Flaggschiffe als Köder: Malware »Yoba« tarnt sich als ChatGPT- und Claude-App
Check Point Research hat eine Kampagne aufgedeckt, die über gefälschte GitHub-Projekte und legitim signierte Dateien von OpenAI und Anthropic Schadsoftware auf Windows-Rechner schleust. Die Projekte tauchten prominent in der Google-Suche auf. Die Sicherheitsforscher von Check Point Research (CPR), der Forschungsabteilung von Check Point® Software Technologies Ltd. , haben eine Malware-Kampagne aufgedeckt, die gezielt das Interesse an……
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware
A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport. First seen on hackread.com Jump to article: hackread.com/fake-github-repo-ai-coding-agents-solanacry-malware/
-
Hugging Face malware campaign returns to hijack GPUs for crypto mining
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/
-
EMBRACE Flaws in 5 AI Coding Tools Enable Code Execution and File Theft
EMBRACE affects AI coding tools Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop, enabling code execution, file theft and browser address-bar spoofing. First seen on hackread.com Jump to article: hackread.com/embrace-flaws-ai-coding-tools-code-execution-theft/
-
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba.The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a…
-
Yoba malware hides in fake desktop versions of ChatGPT and Claude
Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/fake-chatgpt-claude-apps-github-yoba-malware-cryptominer/
-
Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop
Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities/
-
GitHub Launches Copilot Fusion to Automatically Select and Combine AI Models for Coding
GitHub has launched Copilot Fusion, a runtime model router and orchestrator that automatically selects AI models and execution patterns for coding tasks. Instead of requiring developers to choose a model for each step, Fusion coordinates reasoning, code generation, debugging, and review, ultimately providing a single cohesive response. The feature is available across all Copilot plans.…
-
GitHub Launches npm Firewall to Block Malicious Packages Before Installation
GitHub has announced that it’s introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time.”The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate,” GitHub said.The feature, which currently supports only npm packages, is available in public…
-
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
The supply chain attack campaign’s shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github