Tag: github
-
News alert: GitGuardian study shows AI coding tools double leak rates as 29M credentials hit GitHub
NEW YORK, Mar.17, 2026, CyberNewswire “, GitGuardian, the security leader behind GitHub’s most installed application, today released the 5th edition of its “State of Secrets Sprawl” report, documenting how mainstream AI adoption in 2025 reshaped software delivery and accelerated the… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/news-alert-gitguardian-study-shows-ai-coding-tools-double-leak-rates-as-29m-credentials-hit-github/
-
GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX
The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/glassworm-malware-hits-400-plus-code-repos-on-github-npm-vscode-openvsx/
-
GitGuardian Reports an 81% Surge of AI-Service Leaks as 29M Secrets Hit Public GitHub
New York, NY, March 17th, 2026, CyberNewswire In 2025, Developer Commits Using Claude Code Show 3.2% Secret Leak Rate vs. 1.5% Baseline. The Human Factor Remains Critical GitGuardian, the security leader behind GitHub’s most installed application, today released the 5th edition of its “State of Secrets Sprawl” report, documenting how mainstream AI adoption in 2025…
-
GitGuardian Reports an 81% Surge of AI-Service Leaks as 29M Secrets Hit Public GitHub
New York, NY, 17th March 2026, CyberNewswire First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/gitguardian-reports-an-81-surge-of-ai-service-leaks-as-29m-secrets-hit-public-github/
-
The State of Secrets Sprawl 2026: AI-Service Leaks Surge 81% and 29M Secrets Hit Public GitHub
GitGuardian’s 5th State of Secrets Sprawl report is here. In this blog, we unpack the key findings behind the 2026 edition, from AI-driven leak growth to the remediation gaps security teams can’t ignore. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/the-state-of-secrets-sprawl-2026-ai-service-leaks-surge-81-and-29m-secrets-hit-public-github/
-
GitGuardian Reports an 81% Surge of AI-Service Leaks as 29M Secrets Hit Public GitHub
New York, NY, 17th March 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/gitguardian-reports-an-81-surge-of-ai-service-leaks-as-29m-secrets-hit-public-github/
-
New Vidar 2.0 Infostealer Spreads via Fake Game Cheats on GitHub, Reddit
The new infostealer campaign spreads Vidar 2.0 via fake game cheats on GitHub and Reddit, stealing crypto, login tokens, and files while targeting young gamers ignoring security warnings First seen on hackread.com Jump to article: hackread.com/vidar-2-0-infostealer-fake-game-cheats-github-reddit/
-
Mysteriöse Malware: Angreifer kapern Github-Projekte und verbreiten Schadcode
Eine Kampagne mit verschlüsselter Malware hat es auf Python-Entwickler abgesehen – allerdings nur, wenn die nicht in Russland sitzen. First seen on golem.de Jump to article: www.golem.de/news/mysterioese-malware-angreifer-kapern-github-projekte-und-verbreiten-schadcode-2603-206592.html
-
GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos
The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of Python repositories.”The attack targets Python projects, including Django apps, ML research code, Streamlit dashboards, and PyPI packages, by appending obfuscated code to files like setup.py, main.py, and app.py,” StepSecurity said. “Anyone…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 88
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages Inside Coruna: Reverse Engineering a Nation-State iOS Exploit Kit From JavaScript ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader New A0Backdoor Linked to…
-
USENIX Security ’25 (Enigma Track) Securing Packages In npm, Homebrew, PyPI, Maven Central, And RubyGems
Presenter: Zach Steindler, GitHub Our thanks to USENIX Security ’25 (Enigma Track) (USENIX ’25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security ’25 (Enigma Track) (USENIX ’25 content on the Organizations’ YouTube Channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/usenix-security-25-enigma-track-securing-packages-in-npm-homebrew-pypi-maven-central-and-rubygems/
-
Supply-chain attack using invisible code hits GitHub and other repositories
Unicode that’s invisible to the human eye was largely abandoned”, until attackers took notice. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/
-
Storm-2561 targets enterprise VPN users with SEO poisoning, fake clients
vpn-fortinet[.]com and ivanti-vpn[.]org, hosting malicious ZIP files on GitHub, the advisory said.The malware itself arrives as a ZIP file containing a Windows Installer package. When a user launches the downloaded installer, it drops a fake Pulse Secure application into a directory that closely mimics a legitimate Pulse Secure installation path, Microsoft said.”This installation path blends…
-
Storm-2561 targets enterprise VPN users with SEO poisoning, fake clients
vpn-fortinet[.]com and ivanti-vpn[.]org, hosting malicious ZIP files on GitHub, the advisory said.The malware itself arrives as a ZIP file containing a Windows Installer package. When a user launches the downloaded installer, it drops a fake Pulse Secure application into a directory that closely mimics a legitimate Pulse Secure installation path, Microsoft said.”This installation path blends…
-
Cyberkriminelle verteilen Malware über GitHub: Wie du die Angriffe erkennst und dich davor schützt
First seen on t3n.de Jump to article: t3n.de/news/cyberkriminelle-malware-github-1733437/
-
Claude Code: Lernplattform mit Jahren an Inhalten bei KI-Panne gelöscht
Ein Entwickler wollte eine Webplattform von Github Pages zu AWS umziehen und ließ sich von Claude Code helfen. Doch das ging gehörig schief. First seen on golem.de Jump to article: www.golem.de/news/claude-code-ki-agent-zerstoert-lernplattform-mit-2-5-jahren-an-inhalten-2603-206299.html
-
OpenClaw Advisory Surge Highlights Blind Spot Between GitHub and CVE Vulnerability Tracking
OpenClaw’s rapid rise has accidentally exposed how far GitHub’s advisory ecosystem has drifted from traditional CVE”‘centric vulnerability tracking. Within roughly three weeks, the project published more than 200 GitHub Security Advisories (GHSA), and its advisory page now lists around 255 disclosures covering command execution controls, authorization checks, allowlist logic, and plugin boundaries. Only a subset…
-
Claude Code: KI-Agent zerstört Lernplattform mit 2,5 Jahren an Inhalten
Ein Entwickler wollte eine Webplattform von Github Pages zu AWS umziehen und ließ sich von Claude Code helfen. Doch das ging gehörig schief. First seen on golem.de Jump to article: www.golem.de/news/claude-code-ki-agent-zerstoert-lernplattform-mit-2-5-jahren-an-inhalten-2603-206299.html
-
Meta’s AI Safety Chief Couldn’t Stop Her Own Agent. What Makes You Think You Can Stop Yours?
Two incidents from the last two weeks of February need to be read together, because separately they look like cautionary anecdotes and together they look like a threat doctrine. Incident One: An autonomous bot called hackerbot-claw attacked seven major open-source repositories”, Microsoft, DataDog, the CNCF, and Trivy among them. It exploited a well-documented GitHub Actions…
-
BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data
A new Windows stealer dubbed BoryptGrab is being distributed through a large, ongoing campaign abusing fake GitHub repositories that pose as free tools, game cheats, and popular utilities. The malware focuses on stealing browser data, cryptocurrency wallet information, and system details, while also grabbing screenshots, common files, Telegram data, Discord tokens, and stored passwords. Attackers created more…
-
AI Bot Hackerbot-Claw Targets Microsoft, DataDog and CNCF GitHub Repos
Security firm Pillar reveals the Chaos Agent in which Hackerbot-Claw, an AI agent, used natural language to compromise major GitHub projects and hijack developer tools. First seen on hackread.com Jump to article: hackread.com/ai-bot-hackerbot-claw-microsoft-datadog-github-repos/
-
WiFi Signals Can Track Human Activity Through Walls by Mapping Body Keypoints
In late February 2026, an open-source project named RuView (formerly WiFi DensePose) surged to the top of GitHub trending lists. This edge AI system proves that everyday WiFi signals can track human movement, estimate body poses, and monitor vital signs through walls, all without using a single camera. While marketed as a privacy-friendly tool for…
-
Massive GitHub malware operation spreads BoryptGrab stealer
Trend Micro found BoryptGrab stealer spreading through 100+ GitHub repositories, stealing browser data, crypto wallets, system information, and user files. Trend Micro uncovered a campaign distributing the BoryptGrab information stealer through more than 100 GitHub repositories. BoryptGrab is designed to collect browser and cryptocurrency wallet data, system details, and common files. Some variants also deploy…
-
Building Bridges, Breaking Pipelines: Introducing Trajan
TL;DR: Trajan is an open-source CI/CD security tool from Praetorian that unifies vulnerability detection and attack validation across GitHub Actions, GitLab CI, Azure DevOps, and Jenkins in a single cross-platform engine. It ships with 32 detection plugins and 24 attack plugins covering poisoned pipeline execution, secrets exposure, self-hosted runner risks, and AI/LLM pipeline vulnerabilities. It……
-
900+ Certificates Used by Fortune 500, Governments Exposed by Key Leaks
A joint study by Google and GitGuardian reveals that over 2,600 valid TLS certificates, protecting Fortune 500 companies and government agencies, were compromised due to private key leaks on GitHub and DockerHub. First seen on hackread.com Jump to article: hackread.com/certificates-fortune-500-gov-exposed-key-leaks/
-
Beware of fake OpenClaw installers, even if Bing points you to GitHub
Tags: githubBing search results pointed victims to GitHub repositories claiming to host OpenClaw installers, but in reality they installed malware. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/beware-of-fake-openclaw-installers-even-if-bing-points-you-to-github/
-
Beware of fake OpenClaw installers, even if Bing points you to GitHub
Tags: githubBing search results pointed victims to GitHub repositories claiming to host OpenClaw installers, but in reality they installed malware. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/beware-of-fake-openclaw-installers-even-if-bing-points-you-to-github/
-
Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware
Fake OpenClaw installers hosted in GitHub repositories and promoted by Microsoft Bing’s AI-enhanced search feature instructed users to run commands that deployed information stealers and proxy malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/