Fake ChatGPT and Claude apps spread Yoba malware through GitHub, using signed executables to load a cryptominer on…

A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.

GitHub code activity reached historic highs in 2026, with over 7.3 billion monthly commits and 40% of pull requests drafted by AI coding agents.

Related Posts:

• Trezor Hardware Wallet Implant Found in Reseller Units
• Microsoft 365 Storage Changes Reduce Family Cloud Quotas
• Claude CarPlay Update Adds Hands-Free AI Voice

The post GitHub Code Activity Surges Amid AI Agent Adoption appeared first on Daily CyberSecurity.

Content AhnLab monitored APT (Advanced Persistent Threat) attacks targeting entities in Korea using its own infrastructure. This report summarizes the classification, statistics, and functional characteristics for each type of domestic APT attacks identified during the month of September 2026. Purpose and Scope The report outlines the distribution methods and execution types of APT attacks identified […]

GitHub has launched Copilot Fusion, a runtime model router and orchestrator that automatically selects AI models and execution patterns for coding tasks. Instead of requiring developers to choose a model for each step, Fusion coordinates reasoning, code generation, debugging, and review, ultimately providing a single cohesive response. The feature is available across all Copilot plans. […]

The post GitHub Launches Copilot Fusion to Automatically Select and Combine AI Models for Coding appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Wiz Research uncovered the Gheist campaign, a Gheist GitHub campaign planting 13,500 rogue branches across 850+ accounts to steal private repo secrets.

Related Posts:

• Exposed Cairn AI Panels Reveal Autonomous Hacking Against Over 1,100 Targets
• GMO Desktop Cloud Breach Exposes 26,000 FX Servers
• Suspected Chinese Operator Uses ARTEX AI Framework in Global Hacking Campaign

The post Gheist Campaign Abuses Stolen GitHub Tokens Across 850 Accounts to Steal Secrets appeared first on Daily CyberSecurity.

The cURL vulnerability reporting policy now routes low and medium severity bugs to public GitHub issues to alleviate maintainer triage burdens.

Related Posts:

• Chrome ClickFix Protection Scans Risky Clipboard Commands
• Apple Blocks WebKit Identity Resolution in Privacy Shift
• UK CMA Moves to Unlock iPhone Contactless Payments

The post cURL Vulnerability Reporting Policy Shifts to GitHub appeared first on Daily CyberSecurity.

An OVHcloud CLI attack swapped GitHub release files with a secret-stealing binary. Learn which versions are hit in this supply chain attack.

Related Posts:

• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
• AdFection Spyware Attack Targets Al Jazeera Devices
• GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps

The post OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build appeared first on Daily CyberSecurity.

OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47 […]

The post Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.

Related Posts:

• Google Updates Chrome VRP Rewards for Memory Flaws
• Google Play AI Apps Revolutionize Android Publishing
• Google Gemini 4 Argon Model Officially Launches

The post npm Trusted Publishing Now Expires After 48 Hours appeared first on Daily CyberSecurity.

Meta has revealed a breach of a GitHub repository that exposed software code and personal information belonging to about 1,500 individuals, most of whom are U.S. employees. The company began notifying affected individuals on October 13, after discovering the intrusion several weeks earlier, which involved the theft of an employee’s credentials. According to Meta’s statement […]

The post Meta GitHub Repositories Compromised, Exposing Software Code and Employee Personal Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.

The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.

A reported leak of 13,000 screenshots shows how AI agents can bypass weak approval and audit controls even when organizations have written policies.

The post AI Agents Leaked 13,000 Screenshots: Why Enterprise Approval Controls Failed appeared first on TechRepublic.

Security researchers have identified 543,699 unique credentials that remain valid despite being exposed in public GitHub repositories. This highlights a persistent failure to revoke secrets once they enter source code. These credentials were verified as active in July 2026, even though many had been publicly accessible for years. Researchers at Truffle Security examined The Stack […]

The post Researchers Find 543,699 Active Credentials Leaked in Public GitHub Repos appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

PixelLeak: an AI agent screenshot leak put 13,000+ internal images from 300+ firms in public GitHub repos. See how it happened and how to check.

Related Posts:

• Meta Muse Secretly Used Humans for AI Phone Calls
• ShinyHunters Syndicate Alleges Major FBI Network Compromise
• Leaked GitHub App Private Keys Expose Critical Infrastructure

The post AI Coding Agents Leak 13,000 Internal Screenshots to Public GitHub Repos appeared first on Daily CyberSecurity.

Overview AhnLab monitored APT (Advanced Persistent Threat) attacks targeting entities in Korea using its own infrastructure. This report summarizes the types and statistics on domestic APT attacks identified during the month of August 2026. Trends of APT Attacks in South Korea Most of the APT attacks detected in South Korea were distributed via spear phishing […]

We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities.

The post OperTraitors: How Kubernetes Operators Betray Your Security Posture appeared first on Unit 42.

GitHub Security Lab has disclosed that its open-source AI security agent identified 24 vulnerabilities in Android applications, including flaws that could enable covert location tracking in OsmAnd and account takeover attacks against Wikipedia for Android.

The findings highlight how targeted AI workflows can help researchers uncover complex mobile logic flaws, while still requiring human validation.

The research used the GitHub Security Lab Taskflow Agent, an open-source framework designed to automate and share AI-assisted security research workflows.

Rather than asking a large language model to scan an entire repository with a general prompt, researchers created Android-specific taskflows that broke audits into smaller stages.

One taskflow identifies mobile entry points, such as exported activities, services, broadcast receivers, and deep links. Another taskflow assesses each entry point against Android-focused vulnerability classes, including insecure intents, confused deputy problems, unsafe broadcasts, cross-app scripting, and WebView risks.

This structure helps the AI understand the relevant attack surface in repositories that may contain mobile, web, and desktop code.

GitHub AI Finds 24 Android Vulnerabilities

One of the most serious findings affected OsmAnd, an Android navigation application with more than 10 million downloads. Researchers found that the app’s exported MapActivity accepted security-sensitive intent extras while importing settings.

Because exported Android activities can receive intents from other applications, a malicious app could supply attacker-controlled values such as silent_import, replace, and export_type_list_key.

The vulnerable logic allowed an unprivileged malicious application to silently import and replace OsmAnd settings without alerting the user. An attacker could modify the application’s map-tile source so that map requests were sent to an attacker-controlled server.

By logging tile coordinates, the attacker could infer a victim’s location and movements. The same weakness could also expose routing requests, including route origins and destinations. At the same time, the user continued using the application normally.

GitHub also detailed an account takeover chain in the Wikipedia Android application. The app registers a wikipedia:// deep link handler to open content inside its WebView. However, the hostname validation used an endsWith() check instead of validating the exact trusted domain.

This allowed a malicious domain such as evil-wikipedia.org to satisfy the suffix check because its name ends with wikipedia.org. An attacker could create a malicious webpage containing a crafted deep link and persuade a victim to open it.

The Wikipedia app could then load attacker-controlled content inside its WebView, potentially making the victim believe they were viewing a legitimate Wikipedia page.

A second domain-suffix validation issue in the application’s cookie-handling code made the attack more severe. The flawed check could cause the WebView to provide Wikimedia cookies to the attacker-controlled page.

Researchers said the stolen data could include a username, long-lived authentication token, and session token valid across Wikimedia projects, including Wikipedia, Wikimedia Commons, Wikidata, and Meta. Chaining the two bugs could therefore result in account takeover after a victim taps a single malicious link.

GitHub cautioned that AI-generated findings must not be accepted without expert review. Large language models can identify code patterns and relevant APIs effectively. However, they can also misjudge severity, overlook mitigating behavior, or generate false positives.

Researchers found that requiring the model to build a proof of concept can improve triage, although human testing remains essential.
The Taskflow Agent and Android audit workflows are publicly available.

GitHub said users need a GitHub Copilot license, and audits can consume substantial premium-model requests because medium-sized repositories may take one to two hours and require many tool calls. The results are stored in an SQLite audit_results table for researcher review.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post GitHub AI Security Agent Finds 24 Android Vulnerabilities Including Account Takeover Flaws appeared first on Cyber Security News.

GitHub Security Lab has disclosed 24 vulnerabilities in Android applications discovered through its open-source AI security agent and specialized audit taskflows. The findings highlight issues that could enable covert location tracking in the OsmAnd navigation app and account takeover attacks against Wikipedia users on Android. Kevin Stubbings, a researcher at GitHub Security Lab, developed targeted […]

The post GitHub AI Agent Uncovers 24 Android App Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Discover why GitHub blocks Outlook and Hotmail for new account registrations. Learn about the persistent fraud and abuse driving this Microsoft email ban.

Related Posts:

• OpenAI to Unveil Project 'O' at DevDay
• KB5002907 Update Causes Unexpected Office Deletions
• Microsoft Unveils the Next Generation of Copilot

The post GitHub Blocks New Outlook and Hotmail Sign-Ups appeared first on Daily CyberSecurity.