Tag: github
-
TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials
Two more GitHub Actions workflows have become the latest to be compromised by credential-stealing malware by a threat actor known as TeamPCP, the cloud-native cybercriminal operation also behind the Trivy supply chain attack.The workflows, both maintained by the supply chain security company Checkmarx, are listed below -checkmarx/ast-github-actioncheckmarx/kics-github-actionCloud security First seen on thehackernews.com Jump to article:…
-
Exploit-Kit veröffentlicht: Leak auf Github gefährdet Millionen von iPhones
Eine neue Version des Exploit-Kits Darksword ist auf Github aufgetaucht. Zahlreiche iPhones lassen sich dadurch mit nur einem Klick infiltrieren. First seen on golem.de Jump to article: www.golem.de/news/exploit-kit-veroeffentlicht-leak-auf-github-gefaehrdet-millionen-von-iphones-2603-206852.html
-
GitHub just made it much harder to ship a vulnerable pull request
GitHub is expanding its application security capabilities with AI-powered security detections designed to identify risks earlier in the development process, with public … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/24/github-ai-powered-detections-code-scanning/
-
GitHub just made it much harder to ship a vulnerable pull request
GitHub is expanding its application security capabilities with AI-powered security detections designed to identify risks earlier in the development process, with public … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/24/github-ai-powered-detections-code-scanning/
-
Someone has publicly leaked an exploit kit that can hack millions of iPhones
Leaked “DarkSword” exploits published to GitHub allow hackers and cybercriminals to target iPhone users running old versions of iOS with spyware, according to cybersecurity researchers. First seen on techcrunch.com Jump to article: techcrunch.com/2026/03/23/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones/
-
Trivy supply-chain attack spreads to Docker, GitHub repos
The TeamPCP hackers behind the Trivy supply-chain attack continued to target Aqua Security, pushing malicious Docker images and hijacking the company’s GitHub organization to tamper with dozens of repositories. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trivy-supply-chain-attack-spreads-to-docker-github-repos/
-
44 Aqua Security repositories defaced after Trivy supply chain breach
Malicious Trivy images on Docker Hub spread infostealer malware, exposing developers after a supply chain attack. Researchers found malicious Trivy images on Docker Hub linked to a supply chain attack. Versions 0.69.40.69.6, now removed, contained TeamPCP infostealer code. Suspicious tags were pushed without matching GitHub releases, increasing the risk to developers using compromised container images.…
-
Trivy vulnerability scanner breach pushed infostealer via GitHub Actions
The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed credential-stealing malware through official releases and GitHub Actions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trivy-vulnerability-scanner-breach-pushed-infostealer-via-github-actions/
-
Trivy vulnerability scanner breach pushed infostealer via GitHub Actions
The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed credential-stealing malware through official releases and GitHub Actions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trivy-vulnerability-scanner-breach-pushed-infostealer-via-github-actions/
-
Trivy Vulnerability Scanner Compromised to Inject Malicious Scripts That Steal Credentials
Tags: attack, breach, credentials, cyber, github, malicious, security-incident, supply-chain, vulnerabilityA highly sophisticated supply chain attack has successfully compromised the official Trivy GitHub Actions repository, severely impacting continuous integration environments. Discovered on March 19, 2026, this breach represents the second major security incident to strike the Trivy ecosystem this month following a prior credential theft. Attackers effectively hijacked 75 out of 76 version tags, transforming…
-
Trivy Vulnerability Scanner Compromised to Inject Malicious Scripts That Steal Credentials
Tags: attack, breach, credentials, cyber, github, malicious, security-incident, supply-chain, vulnerabilityA highly sophisticated supply chain attack has successfully compromised the official Trivy GitHub Actions repository, severely impacting continuous integration environments. Discovered on March 19, 2026, this breach represents the second major security incident to strike the Trivy ecosystem this month following a prior credential theft. Attackers effectively hijacked 75 out of 76 version tags, transforming…
-
Trivy vulnerability scanner backdoored with credential stealer in supply chain attack
Tags: access, attack, breach, cloud, control, credentials, crypto, data, detection, docker, email, exploit, github, kubernetes, malicious, malware, network, risk, supply-chain, vulnerabilityAttackers look for development secrets: On GitHub Actions runners, the credential stealer reads the process memory to extract secrets and searches the filesystem for SSH keys, cloud provider credentials, Kubernetes tokens, Docker registry configurations, and cryptocurrency wallets.The stolen data is encrypted and sent to a typosquatted domain that mimics Aqua Security’s legitimate site. If this…
-
Trivy vulnerability scanner backdoored with credential stealer in supply chain attack
Tags: access, attack, breach, cloud, control, credentials, crypto, data, detection, docker, email, exploit, github, kubernetes, malicious, malware, network, risk, supply-chain, vulnerabilityAttackers look for development secrets: On GitHub Actions runners, the credential stealer reads the process memory to extract secrets and searches the filesystem for SSH keys, cloud provider credentials, Kubernetes tokens, Docker registry configurations, and cryptocurrency wallets.The stolen data is encrypted and sent to a typosquatted domain that mimics Aqua Security’s legitimate site. If this…
-
Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets
Trivy, a popular open-source vulnerability scanner maintained by Aqua Security, was compromised a second time within the span of a month to deliver malware that stole sensitive CI/CD secrets.The latest incident impacted GitHub Actions “aquasecurity/trivy-action” and “aquasecurity/setup-trivy,” which are used to scan Docker container images for vulnerabilities and set up GitHub Actions workflow First seen…
-
Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets
Trivy, a popular open-source vulnerability scanner maintained by Aqua Security, was compromised a second time within the span of a month to deliver malware that stole sensitive CI/CD secrets.The latest incident impacted GitHub Actions “aquasecurity/trivy-action” and “aquasecurity/setup-trivy,” which are used to scan Docker container images for vulnerabilities and set up GitHub Actions workflow First seen…
-
Specterops erweitert sein Attack-Path-Management für Identitäten auf Okta, Github und Mac
Specterops, Entwickler von Bloodhound und führender Anbieter für Identity-Attack-Path-Management (APM), erweitert seine Lösung um die Unterstützung für Okta, Github und Mac-Umgebungen. Mit den neuen Opengraph-Erweiterungen in Bloodhound-Enterprise können Identity- und Sicherheitsteams plattformübergreifende Angriffspfade (Attack-Paths) gezielt erkennen und schließen. Darüber hinaus sorgen privilegierte Zugriffszonen für den Schutz kritischer Unternehmenswerte wie Code-Repositorys und sensibler Kundendaten. Specterops präsentiert…
-
SpecterOps erweitert Identity Attack Path Management auf Okta, GitHub und Mac
SpecterOps entwickelt und pflegt weit verbreitete Open-Source-Sicherheitstools, allen voran BloodHound das Tool für effektives Identity Attack Path Management. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/specterops-erweitert-identity-attack-path-management-auf-okta-github-und-mac/a44204/
-
How AI Code Assistants Change Application Security
<div cla TL;DR AI code assistants accelerate development velocity, with 46% of code now completed by tools like GitHub Copilot. This speed creates a security challenge: vulnerabilities reach production faster than traditional scanning can catch them. The solution is to adapt security approaches to match development velocity through runtime visibility that monitors application behavior, regardless…
-
Open VSX Extension Delivers RAT and Stealer via GitHub Downloader
An Open VSX extension used by thousands of developers has been caught silently pulling a full-featured remote access trojan and infostealer from GitHub. The KhangNghiem/fast-draft extension, listed on open-vsx.org and tracked at over 26,000 downloads as of March 17, 2026, contained multiple malicious releases that executed a GitHub-hosted downloader and fetched a second-stage payload from…
-
Technical Analysis of SnappyClient
Tags: access, antivirus, api, attack, browser, chrome, cloud, communications, computer, control, credentials, crypto, data, defense, detection, encryption, endpoint, finance, framework, github, infection, injection, jobs, login, malicious, malware, network, password, software, startup, theft, threat, update, windowsIntroductionIn December 2025, Zscaler ThreatLabz identified a new command-and-control (C2) framework implant that we track as SnappyClient, which was delivered using HijackLoader. SnappyClient has an extended list of capabilities including taking screenshots, keylogging, a remote terminal, and data theft from browsers, extensions, and other applications. In this blog post, ThreatLabz provides a technical analysis of SnappyClient, including…
-
ForceMemo Hijacks GitHub Accounts, Backdoors Python Repos
ForceMemo is an active software supply”‘chain campaign hijacking GitHub accounts and silently backdooring Python repositories via force”‘pushed commits that look legitimate in the web UI. It builds on GlassWorm’s stolen”‘token ecosystem and uses the Solana blockchain as a resilient command”‘and”‘control (C2) channel, making detection and takedown significantly harder. The attacker targets a wide range of…
-
Vidar Stealer 2.0 Exploits GitHub, Reddit to Deliver Malware via Fake Game Cheats
The Vidar 2.0 infostealers is deployed through fake free game cheats on GitHub and Reddit First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vidar-stealer-exploits-github/
-
Big tech companies step in to support the open source security ecosystem
The Linux Foundation announced $12.5 million in grant funding backed by Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen open source … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/18/linux-foundation-open-source-security-12-5-million-funding/
-
KI beschleunigt die unkontrollierte Verbreitung von Zugangsdaten um ein Vielfaches
Im Jahr 2025 weisen Entwickler-Commits mit Claude Code* eine Leak-Rate von 3,2 Prozent bei Zugangsdaten auf, gegenüber einem Basiswert von 1,5 Prozent. Der menschliche Faktor bleibt entscheidend. GitGuardian, der Sicherheitsanbieter hinter der meistinstallierten Anwendung auf GitHub, veröffentlicht die fünfte Ausgabe seines Berichts »State of Secrets Sprawl« (Lagebericht zur Ausbreitung von Zugangsdaten) [1]. Der Lagebericht… First…
-
Vidar Stealer 2.0 Spreads via Fake Game Cheats Shared on GitHub and Reddit
Large”‘scale campaigns abusing GitHub and Reddit to spread Vidar Stealer 2.0 through fake “free game cheats,” targeting players of popular online titles across the board. The operation shows how the takedown of other infostealers has shifted criminal demand toward Vidar, while gaming communities remain a lucrative and under”‘reported target. Attackers hide download links behind images…
-
Judicial Targets Hit by COVERT RAT via Court Docs and GitHub Payloads
Attackers are abusing fake court documents and GitHub”‘hosted payloads in a focused spear”‘phishing campaign that deploys a stealthy Rust”‘based COVERT RAT against Argentina’s judicial sector. This operation chains Windows LNK shortcuts, BAT loaders, and PowerShell to quietly fetch and execute a masqueraded payload, msedge_proxy.exe, from GitHub infrastructure. The operation, tracked as “Operation Covert Access,” uses…
-
News alert: GitGuardian study shows AI coding tools double leak rates as 29M credentials hit GitHub
NEW YORK, Mar.17, 2026, CyberNewswire “, GitGuardian, the security leader behind GitHub’s most installed application, today released the 5th edition of its “State of Secrets Sprawl” report, documenting how mainstream AI adoption in 2025 reshaped software delivery and accelerated the… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/news-alert-gitguardian-study-shows-ai-coding-tools-double-leak-rates-as-29m-credentials-hit-github/
-
News alert: GitGuardian study shows AI coding tools double leak rates as 29M credentials hit GitHub
NEW YORK, Mar.17, 2026, CyberNewswire “, GitGuardian, the security leader behind GitHub’s most installed application, today released the 5th edition of its “State of Secrets Sprawl” report, documenting how mainstream AI adoption in 2025 reshaped software delivery and accelerated the… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/news-alert-gitguardian-study-shows-ai-coding-tools-double-leak-rates-as-29m-credentials-hit-github/