Apiiro found Claude Code leaking secrets in 1,994 repos via a GitHub settings.local.json exposure. Learn how to check and secure your credentials.
Related Posts:
York University Data Breach Exposes Years of Departmental Webform Submissions
DreamHost Security Breach Exposes FTP and Webmail Data
DigiCert Data Exposure Reveals Customer Contact Records and Identity Documents
The post Claude Code Leaking Secrets Across Nearly Two Thousand Public GitHub Repositories appeared first on Daily CyberSec
Fake GitHub security tools are spreading malware that disables defenses, steals sensitive data and infects over 2,000 PCs.
Cybersecurity firm Doctor Web has found malware hidden in GitHub projects that look like security tools. The campaign targets blockchain game fans and, more recently, information security professionals. The researchers discovered that more than 2,000 PCs were infected.
“The attackers behind these compromised development projects target blockchain game enthusiasts and
Fake GitHub security tools are spreading malware that disables defenses, steals sensitive data and infects over 2,000 PCs.
Cybersecurity firm Doctor Web has found malware hidden in GitHub projects that look like security tools. The campaign targets blockchain game fans and, more recently, information security professionals. The researchers discovered that more than 2,000 PCs were infected.
“The attackers behind these compromised development projects target blockchain game enthusiasts and (most intriguingly) …information security professionals.” reads the report. “At the time of Doctor Web’s research into this matter, more than 2,000 PCs were infected.”
The campaign started two years ago with Visual Studio projects related to blockchain games, game bots and cheats. The attackers targeted people who used crypto wallets. They hid malicious code in project files, including commands that ran before a project was built and PowerShell commands stored in configuration files. They even provided instructions on how to install Visual Studio and download the projects from GitHub, making it easy for people with limited technical knowledge to use them.
Now the attackers are targeting cybersecurity professionals. Their new GitHub projects claim to offer tools for automated scanning, security testing and log analysis. Doctor Web found one that pretends to analyze and clean results from the Fscan security scanner.
The attackers also hide malicious code in Python and Go files, using large blocks of blank spaces to make it harder to spot. Some of these fake security tools even remove the antivirus software installed on the victim’s computer.
Once a victim opens the project, a PowerShell script runs and contacts the attackers’ servers and legitimate platforms, including YouTube, Telegram, Google Docs, GitCode and Pastebin. An encrypted string it retrieves holds a link to an archive, which unpacks into a folder disguised as a Windows Photos component. Its main program is Microsoft.exe, a modular app built with the Electron framework.
It does most of the damage. The loader collects system information and sends it to a Telegram bot, keeps itself running, raises its privileges, and turns off Windows Defender, UAC, System Restore and shadow copies. It also adds its own Defender exclusions, injects code into legitimate processes, and removes McAfee, ESET and Malwarebytes antivirus products.
Its default mode, called Mode3, stacks several evasion tricks. It fakes its parent process, disables Smart App Control, removes security software hooks from ntdll.dll, makes direct system calls, and patches event tracing and antivirus script scanning in memory. If that fails, Mode2 takes over, adding Defender exclusions and injecting through PowerShell.
Three payloads follow. AsyncRAT, a remote access backdoor, runs as two identical copies on different ports, which probably lets two operators control one device. A clipper swaps crypto wallet addresses in the clipboard while taking screenshots, and a stealer takes browser data, FileZilla, MobaXterm and Total Commander configs, VPN settings, messenger files, game accounts and Discord tokens. Everything is zipped and sent through Telegram, and the malware edits the hosts file to block antivirus vendors’ domains.
The attackers are still developing the malware. Doctor Web found an unfinished component that could install itself as a system service, download Microsoft.exe again if someone deletes it, manage startup and install updates.
“Attackers are constantly updating the Trojans to introduce new features. For example, Doctor Web’s researchers discovered certain unused routines that facilitate downloading and decompressing yet another archive—Lodge.7z.” concludes the report. “It contains an Electron project that hasn’t been completed yet. The executable file’s name is WUDFHost.exe. Its code offers us a glimpse of some of the trojan’s future features.”
Doctor Web advises users to keep their antivirus software up to date and scan every file they download. The researchers warn that attackers are constantly improving the Trojans and adding new features.
A new wave of the GhostAction supply chain campaign has pushed a credential-stealing GitHub Actions workflow into tens of thousands of repositories. It now hunts for cloud and AI keys buried in source code and git history, in addition to CI/CD secrets. Socket says it has identified more than 500 GitHub accounts that committed the […]
The post GhostAction Attack Hits Tens of Thousands of GitHub Repositories to Steal Cloud and AI Credentials appeared first on GBHackers Security | #1 Globally Trust
A new wave of the GhostAction supply chain campaign has pushed a credential-stealing GitHub Actions workflow into tens of thousands of repositories. It now hunts for cloud and AI keys buried in source code and git history, in addition to CI/CD secrets. Socket says it has identified more than 500 GitHub accounts that committed the […]
A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.
A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.
GitHub code activity reached historic highs in 2026, with over 7.3 billion monthly commits and 40% of pull requests drafted by AI coding agents.
Related Posts:
Trezor Hardware Wallet Implant Found in Reseller Units
Microsoft 365 Storage Changes Reduce Family Cloud Quotas
Claude CarPlay Update Adds Hands-Free AI Voice
The post GitHub Code Activity Surges Amid AI Agent Adoption appeared first on Daily CyberSecurity.
GitHub has launched Copilot Fusion, a runtime model router and orchestrator that automatically selects AI models and execution patterns for coding tasks. Instead of requiring developers to choose a model for each step, Fusion coordinates reasoning, code generation, debugging, and review, ultimately providing a single cohesive response. The feature is available across all Copilot plans. […]
The post GitHub Launches Copilot Fusion to Automatically Select and Combine AI Models for Coding appeared f
GitHub has launched Copilot Fusion, a runtime model router and orchestrator that automatically selects AI models and execution patterns for coding tasks. Instead of requiring developers to choose a model for each step, Fusion coordinates reasoning, code generation, debugging, and review, ultimately providing a single cohesive response. The feature is available across all Copilot plans. […]
Wiz Research uncovered the Gheist campaign, a Gheist GitHub campaign planting 13,500 rogue branches across 850+ accounts to steal private repo secrets.
Related Posts:
Exposed Cairn AI Panels Reveal Autonomous Hacking Against Over 1,100 Targets
GMO Desktop Cloud Breach Exposes 26,000 FX Servers
Suspected Chinese Operator Uses ARTEX AI Framework in Global Hacking Campaign
The post Gheist Campaign Abuses Stolen GitHub Tokens Across 850 Accounts to Steal Secrets appeared first on Daily CyberSecur
Wiz Research uncovered the Gheist campaign, a Gheist GitHub campaign planting 13,500 rogue branches across 850+ accounts to steal private repo secrets.
The cURL vulnerability reporting policy now routes low and medium severity bugs to public GitHub issues to alleviate maintainer triage burdens.
Related Posts:
Chrome ClickFix Protection Scans Risky Clipboard Commands
Apple Blocks WebKit Identity Resolution in Privacy Shift
UK CMA Moves to Unlock iPhone Contactless Payments
The post cURL Vulnerability Reporting Policy Shifts to GitHub appeared first on Daily CyberSecurity.
An OVHcloud CLI attack swapped GitHub release files with a secret-stealing binary. Learn which versions are hit in this supply chain attack.
Related Posts:
Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
AdFection Spyware Attack Targets Al Jazeera Devices
GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps
The post OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build appeared first on Daily CyberSecurity.
OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47 […]
The post Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware appeared first
OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47 […]
GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.
Related Posts:
Google Updates Chrome VRP Rewards for Memory Flaws
Google Play AI Apps Revolutionize Android Publishing
Google Gemini 4 Argon Model Officially Launches
The post npm Trusted Publishing Now Expires After 48 Hours appeared first on Daily CyberSecurity.
Meta has revealed a breach of a GitHub repository that exposed software code and personal information belonging to about 1,500 individuals, most of whom are U.S. employees. The company began notifying affected individuals on October 13, after discovering the intrusion several weeks earlier, which involved the theft of an employee’s credentials. According to Meta’s statement […]
The post Meta GitHub Repositories Compromised, Exposing Software Code and Employee Personal Data appeared first on GBHa
Meta has revealed a breach of a GitHub repository that exposed software code and personal information belonging to about 1,500 individuals, most of whom are U.S. employees. The company began notifying affected individuals on October 13, after discovering the intrusion several weeks earlier, which involved the theft of an employee’s credentials. According to Meta’s statement […]
A reported leak of 13,000 screenshots shows how AI agents can bypass weak approval and audit controls even when organizations have written policies.
The post AI Agents Leaked 13,000 Screenshots: Why Enterprise Approval Controls Failed appeared first on TechRepublic.
Security researchers have identified 543,699 unique credentials that remain valid despite being exposed in public GitHub repositories. This highlights a persistent failure to revoke secrets once they enter source code. These credentials were verified as active in July 2026, even though many had been publicly accessible for years. Researchers at Truffle Security examined The Stack […]
The post Researchers Find 543,699 Active Credentials Leaked in Public GitHub Repos appeared first on GBHackers Se
Security researchers have identified 543,699 unique credentials that remain valid despite being exposed in public GitHub repositories. This highlights a persistent failure to revoke secrets once they enter source code. These credentials were verified as active in July 2026, even though many had been publicly accessible for years. Researchers at Truffle Security examined The Stack […]
PixelLeak: an AI agent screenshot leak put 13,000+ internal images from 300+ firms in public GitHub repos. See how it happened and how to check.
Related Posts:
Meta Muse Secretly Used Humans for AI Phone Calls
ShinyHunters Syndicate Alleges Major FBI Network Compromise
Leaked GitHub App Private Keys Expose Critical Infrastructure
The post AI Coding Agents Leak 13,000 Internal Screenshots to Public GitHub Repos appeared first on Daily CyberSecurity.
GitHub Security Lab has disclosed that its open-source AI security agent identified 24 vulnerabilities in Android applications, including flaws that could enable covert location tracking in OsmAnd and account takeover attacks against Wikipedia for Android.
The findings highlight how targeted AI workflows can help researchers uncover complex mobile logic flaws, while still requiring human validation.
The research used the GitHub Security Lab Taskflow Agent, an open-source framework designed
GitHub Security Lab has disclosed that its open-source AI security agent identified 24 vulnerabilities in Android applications, including flaws that could enable covert location tracking in OsmAnd and account takeover attacks against Wikipedia for Android.
The findings highlight how targeted AI workflows can help researchers uncover complex mobile logic flaws, while still requiring human validation.
The research used the GitHub Security Lab Taskflow Agent, an open-source framework designed to automate and share AI-assisted security research workflows.
Rather than asking a large language model to scan an entire repository with a general prompt, researchers created Android-specific taskflows that broke audits into smaller stages.
One taskflow identifies mobile entry points, such as exported activities, services, broadcast receivers, and deep links. Another taskflow assesses each entry point against Android-focused vulnerability classes, including insecure intents, confused deputy problems, unsafe broadcasts, cross-app scripting, and WebView risks.
This structure helps the AI understand the relevant attack surface in repositories that may contain mobile, web, and desktop code.
GitHub AI Finds 24 Android Vulnerabilities
One of the most serious findings affected OsmAnd, an Android navigation application with more than 10 million downloads. Researchers found that the app’s exported MapActivity accepted security-sensitive intent extras while importing settings.
Because exported Android activities can receive intents from other applications, a malicious app could supply attacker-controlled values such as silent_import, replace, and export_type_list_key.
The vulnerable logic allowed an unprivileged malicious application to silently import and replace OsmAnd settings without alerting the user. An attacker could modify the application’s map-tile source so that map requests were sent to an attacker-controlled server.
By logging tile coordinates, the attacker could infer a victim’s location and movements. The same weakness could also expose routing requests, including route origins and destinations. At the same time, the user continued using the application normally.
GitHub also detailed an account takeover chain in the Wikipedia Android application. The app registers a wikipedia:// deep link handler to open content inside its WebView. However, the hostname validation used an endsWith() check instead of validating the exact trusted domain.
This allowed a malicious domain such as evil-wikipedia.org to satisfy the suffix check because its name ends with wikipedia.org. An attacker could create a malicious webpage containing a crafted deep link and persuade a victim to open it.
The Wikipedia app could then load attacker-controlled content inside its WebView, potentially making the victim believe they were viewing a legitimate Wikipedia page.
A second domain-suffix validation issue in the application’s cookie-handling code made the attack more severe. The flawed check could cause the WebView to provide Wikimedia cookies to the attacker-controlled page.
Researchers said the stolen data could include a username, long-lived authentication token, and session token valid across Wikimedia projects, including Wikipedia, Wikimedia Commons, Wikidata, and Meta. Chaining the two bugs could therefore result in account takeover after a victim taps a single malicious link.
GitHub cautioned that AI-generated findings must not be accepted without expert review. Large language models can identify code patterns and relevant APIs effectively. However, they can also misjudge severity, overlook mitigating behavior, or generate false positives.
Researchers found that requiring the model to build a proof of concept can improve triage, although human testing remains essential. The Taskflow Agent and Android audit workflows are publicly available.
GitHub said users need a GitHub Copilot license, and audits can consume substantial premium-model requests because medium-sized repositories may take one to two hours and require many tool calls. The results are stored in an SQLite audit_results table for researcher review.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response:Integrate TI Lookup in your SOC
GitHub Security Lab has disclosed 24 vulnerabilities in Android applications discovered through its open-source AI security agent and specialized audit taskflows. The findings highlight issues that could enable covert location tracking in the OsmAnd navigation app and account takeover attacks against Wikipedia users on Android. Kevin Stubbings, a researcher at GitHub Security Lab, developed targeted […]
The post GitHub AI Agent Uncovers 24 Android App Vulnerabilities appeared first on GBHackers
GitHub Security Lab has disclosed 24 vulnerabilities in Android applications discovered through its open-source AI security agent and specialized audit taskflows. The findings highlight issues that could enable covert location tracking in the OsmAnd navigation app and account takeover attacks against Wikipedia users on Android. Kevin Stubbings, a researcher at GitHub Security Lab, developed targeted […]
Discover why GitHub blocks Outlook and Hotmail for new account registrations. Learn about the persistent fraud and abuse driving this Microsoft email ban.
Related Posts:
OpenAI to Unveil Project 'O' at DevDay
KB5002907 Update Causes Unexpected Office Deletions
Microsoft Unveils the Next Generation of Copilot
The post GitHub Blocks New Outlook and Hotmail Sign-Ups appeared first on Daily CyberSecurity.
Discover why GitHub blocks Outlook and Hotmail for new account registrations. Learn about the persistent fraud and abuse driving this Microsoft email ban.
Entrar
