Category: Cybersecurity & Malware

Cybersecurity researchers have identified a major credential-theft campaign targeting GitHub repositories. Attackers compromised two high-profile open-source maintainer accounts and injected malicious workflows into over 340 repositories. The first attack used the account of Takashi Kitao, creator of the pyxel game engine, to push malicious code to 27 repositories. Hours later, Henry Wu’s account was exploited to distribute the same workflow to 318 repositories within a 16-minute window. Since early October 2026, security researchers have discovered more than 500 compromised GitHub accounts that have distributed the malicious workflow to tens of thousands of repositories.

The attack, attributed to the GhostAction campaign, uses workflows disguised as security audits to steal sensitive credentials including AWS keys, API tokens from cloud and artificial intelligence providers, and authentication tokens from various development platforms. The malicious code scans both active repositories and their complete git history to extract secrets, then transmits the stolen data to attacker-controlled servers. Developers are urged to check their repositories for these malicious workflows since late August 2026, revoke compromised credentials, and delete the malicious files from all branches, particularly in forked repositories where the threat persists.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Raheim Hamilton, the 30-year-old co-creator of Empire Market, a dark web marketplace, received a 40-year prison sentence this week for facilitating the sale of drugs, hacking tools, and stolen information. Hamilton pleaded guilty to drug conspiracy charges and agreed to forfeit more than $100 million in bitcoin and several Virginia properties. U.S. District Judge Steven Seeger also imposed a $5 million fine on Hamilton.

Empire Market, operated by Hamilton and Thomas Pavey from 2018 to 2020, hosted over 4 million transactions totaling $430 million, with approximately $375 million derived from drug sales including fentanyl, cocaine, methamphetamine, and heroin. The platform’s popularity stemmed from encryption services and cryptocurrency laundering capabilities. The marketplace suddenly closed in summer 2020 with operators allegedly stealing $30 million in bitcoin from users. Pavey, Hamilton’s co-operator, pleaded guilty and awaits sentencing later this month.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Microsoft has announced that devices running outdated versions of Windows will lose access to security updates after the company rotates its Windows Update certificates in May and June 2027. To continue receiving updates, administrators and users must upgrade to a supported Windows version before these certificates expire. Microsoft emphasized that unsupported devices will be unable to access Windows Update services and will not receive any updates following the certificate rotation.

The company provided specific guidance for different Windows versions. Supported versions only need a recent security update installed: the September 2025 update or later for Windows 11 24H2 and Windows Server 2025, and the July 2026 update or later for Windows 10 and other supported versions. Windows 11 25H2 and later need no action, while unsupported versions must be upgraded entirely. The certificates expire on May 17 and June 19, 2027. Microsoft recommended that IT administrators identify all devices running older Windows versions, deploy monthly updates to supported devices, and create upgrade plans for unsupported systems before the 2027 deadline. Devices using Windows Server Update Services for updates are exempt from this requirement.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

The FBI has seized seven domains operated by Chinese state-sponsored hackers known as Flax Typhoon to disrupt two hacking tools used in attacks on critical infrastructure worldwide. The tools, MicroScan and FishHub, were allegedly operated by China-based Integrity Technology Group, which U.S. authorities say has contracts with the Chinese government. MicroScan is a vulnerability-scanning platform that identified security weaknesses in targeted networks, while FishHub conducted spear-phishing attacks and delivered malware to already-compromised systems. Targets included a South Carolina power company, airports in Japan and Poland, Taiwanese energy companies, and universities across multiple countries.

In coordination with the domain seizures, the FBI, CISA, NSA, and international partners issued a joint cybersecurity advisory detailing how Chinese hackers used these tools to compromise organizations and steal sensitive information. The attackers targeted U.S. government agencies, critical manufacturing, healthcare, and educational institutions, as well as organizations in Southeast Asia, Africa, and North America. Authorities are urging organizations to review provided indicators of compromise, patch vulnerable systems, and enforce multifactor authentication. This disruption follows a previous action in September 2024 against an Integrity Tech-operated botnet and sanctions imposed by the UK and European Union against the company.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Researchers at Romania-based Bitdefender discovered malware preinstalled on thousands of inexpensive Android phones sold globally. The malicious software, named Midnight Mimosa, targets devices using MediaTek chips and cannot be removed by users. The malware operates with system-level privileges, allowing it to silently install applications, modify permissions, and execute code without approval. Over approximately two years, the campaign affected thousands of devices across more than 150 countries, with Mexico, France, and Italy experiencing the highest concentrations of infected phones.

The malware primarily generates revenue through advertising and click fraud schemes. It secretly installs disguised applications that display ads in invisible windows, creating fake impressions users never see. Researchers identified at least 32 such applications deployed by the preinstalled malware and discovered 13 additional malicious apps on Google Play Store using similar code. The affected phones are typically low-cost, white-label, or counterfeit devices resembling popular brands, sold through mainstream online marketplaces for approximately $180. Bitdefender could not determine who introduced the malware into the supply chain.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

The FakeGit malware campaign has resumed operations with over 17,000 malicious repositories on GitHub, distributing SmartLoader malware that can deploy additional threats. Researchers from Apiiro discovered the campaign reactivated on October 4, adding more than 13,000 repositories in just 34 hours. The attack uses convincing README files with download buttons linking to infected ZIP files. While most accounts involved are disposable, at least 700 accounts belonging to legitimate developers have been compromised and repurposed for the campaign.

Security experts attribute the campaign’s persistence to limitations in removal efforts and the attackers’ ability to redirect downloads while keeping repositories active. Malicious files are distributed across multiple locations including repository forks, release assets, and issue attachments, making deletion ineffective. Researchers recommend users verify repository ownership before downloading, use official registries for AI tools, and treat any SmartLoader execution as a potential account compromise requiring immediate session revocation and token resets.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

The first day of the Pwn2Own Ireland 2026 hacking competition saw security researchers exploit 32 zero-day vulnerabilities across various devices. Multiple teams successfully compromised the Samsung Galaxy S26 smartphone, with three different groups earning a combined $388,500 for their efforts. The competition featured seven categories of targets, including mobile phones, printers, smart home devices, messaging apps, and AI-related systems. Some of the vulnerabilities discovered had already been known to manufacturers beforehand.

Leading the leaderboard, researchers from VinSOC won $80,000 by chaining multiple zero-day exploits to compromise a Philips Hue Bridge Pro smart lighting hub and an Oracle Autonomous AI Database. Additional achievements included hacking printers from Lexmark and Canon, exploiting vulnerabilities in smart speakers and AI coding agents, and compromising various smart home devices. One team attempted to hack the Google Pixel 10 but ran out of time before completing their exploit. The Zero Day Initiative organizes the competition to identify security flaws before malicious actors can use them, with vendors receiving 90 days to patch vulnerabilities before public disclosure.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

The FBI and Secret Service have issued a warning about FortiBleed, an ongoing campaign targeting over 86,000 internet-facing Fortinet FortiGate firewalls and VPN gateways across 194 countries. The credential-stealing attacks exploit reused or leaked credentials to harvest and crack authentication data at scale. Attackers continue to scan exposed Fortinet devices, potentially locking organizations out of their systems by disabling accounts or changing passwords. The FortiBleed campaign has also served as an initial entry point for ransomware affiliates associated with INC/Lynx and Payload ransomware.

Federal agencies discovered details about the operation after hackers exposed their own backend server, revealing their internal workflow and methods. The attackers scanned the internet for exposed FortiGate portals, used automated scripts to identify devices, and collected credentials through credential stuffing and password spraying. Stolen credentials were then validated, organized by victim organization characteristics, and either sold to others or used directly for continued access. The FBI and Secret Service recommend organizations review all Fortinet accounts, restrict external device management, reset credentials, and terminate all admin VPN sessions.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Microsoft will begin blocking .msix and .msixbundle file attachments in Outlook Web and the new Outlook Windows client starting in November. These file types are modern Windows installation packages used for specific computer configurations, with .msixbundle serving as a container for multiple packages. The rollout will commence in early November for Exchange Online users, with full availability expected by mid-November. Once implemented, users will be unable to send, receive, open, or download these attachment types.

The security measure is part of Microsoft’s broader initiative to disable features that attackers have exploited in recent years. Most organizations are expected to be unaffected since these file types are rarely used. However, administrators can whitelist the attachments if necessary through their organization’s OwaMailboxPolicy settings. This update follows previous Outlook security enhancements, including the blocking of .library-ms and .search-ms files in June and restrictions on inline SVG images in October.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Zohar Pinhasi, owner of ransomware recovery company MonsterCloud, has been charged with defrauding victims by secretly paying ransomware operators for decryption keys while falsely claiming to use proprietary technology. The 50-year-old was indicted in September and arraigned in Brooklyn federal court on charges including wire fraud conspiracy. Prosecutors allege the scheme operated from June 2018 to June 2023, with Pinhasi and associates facilitating over $8 million in ransom payments while charging victims more than $19 million for recovery services.

According to the indictment, MonsterCloud advertised decryption methods that did not involve paying cybercriminals, though some contracts acknowledged potential communication with attackers. Prosecutors claim contacting ransomware operators was typically the company’s first approach rather than a last resort. In specific cases cited, Pinhasi allegedly paid approximately $8,200 to a ransomware gang while charging the victim $150,000, and paid about $236,000 while charging another customer $380,000. If convicted, Pinhasi faces up to 20 years in prison. He was released on a $2 million bond after pleading not guilty.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.