Tag: threat actor
49 articles
FakeGit Campaign Resurfaces, Spawns 17,610 Malicious GitHub Repos
In a shocking resurgence, the FakeGit campaign sprang back to life on October 4, hijacking 17,610 dormant GitHub repositories to deliver malware at an alarming rate of nearly 3,000 per hour. The attackers cleverly exploited existing repositories, needing to create zero new ones to unleash this massive threat.
Malware Exploits AI Systems with 'Adversarial Poetry
Meet the first-ever malware that uses a clever trick - a poem - to hijack AI systems and steer them to its command center, cleverly hidden in a forked GitHub repository. This sneaky tactic was uncovered by Lumen's Black Lotus Labs, revealing a new level of sophistication in cyber threats.
Telegram Account Tied to ASOS Hack Exposed in Gaming Trading Forums
A surprising twist in the ASOS hack reveals a Telegram account, previously linked to gaming item trading, was used to administer a channel tied to the breach, sparking questions about the hacker's true identity. The account, now labelled 'Xuanyewen', has a history that predates the incident, suggesting a calculated setup.
ASOS Breach Exposes Customer Data After Hackers Compromise App
ASOS app users were shocked to receive a disturbing push notification at 5am ET on Tuesday, claiming that the company had been hacked and data compromised. The alert, which appeared to come from hackers, even taunted ASOS's data protection team, threatening to leak sensitive information if not contacted.
Malware Modules Disable Windows Update, Defender for Crypto Mining
Meet LockAppHost, a notorious malware module that cripples your Windows defenses by disabling updates and Microsoft Defender, making way for a sneaky cryptocurrency miner to take over. By weakening your machine's security, it allows the miner to run undetected, wreaking havoc on your system.
Hackers exploit BGP hijacking to deliver malicious Virtualizor updates
Malicious actors hijacked internet traffic to deliver fake Virtualizor updates to a small number of users, exploiting a vulnerability in the Border Gateway Protocol (BGP) to divert update requests to their own servers. This sneaky move allowed them to push malicious updates to unsuspecting users.
npm Packages Host Fake Cloudflare CAPTCHA Pages via Unpkg Mirrors
Researchers uncovered a sneaky scam where attackers hide a fake Cloudflare CAPTCHA page inside harmless-looking npm packages, using mirrors to trick victims into revealing sensitive info. This clever tactic relies on exploiting trusted domains to deploy a ClickFix-style scam that redirects users to attacker-controlled infrastructure.
Azure Breach Exposes Millions of Employee Records at Top Firms
A threat actor known as TheHatman is peddling a staggering 1.7 million employee records from McDonald's, along with millions more from other top firms, allegedly stolen from Microsoft Azure environments. The breach, which Hudson Rock deems highly authentic, has left giants like Vodafone, Tata Consultancy Services, and IHG Hotels & Resorts vulnerable.
Hackers Exploit Adform Script to Swap Crypto Wallet Addresses
Beware: hackers have cleverly manipulated a popular ad script to swap crypto wallet addresses, allowing them to intercept your transactions even if you double-check and recopy the address. This sneaky tactic uses a cleverly hidden code to override your wallet details in real-time.
MCBS Data Breach Exposes 1.26 Million People's Sensitive Information
A massive data breach at Medical Computer Business Services (MCBS) has put the sensitive information of over 1.26 million people at risk, with a threat actor claiming to have stolen a staggering 3.3 terabytes of data. The breach, which occurred in September 2025, exposed personal data handled by the medical billing and practice-management company.
Google's Gemini CLI Exploited in Botnet Operation
A Russian-speaking hacker, known as "bandcampro", cleverly exploited Google's open-source Gemini CLI AI tool to create a small but powerful botnet, taking control of eight systems at a dental clinic and breaching the OpenDental database. The AI tool even helped the hacker troubleshoot problems and optimize operations in real-time, making it a highly effective accomplice in the cyber attack.
Multiple Breaches Expose Millions in June
A massive data breach at Madison Square Garden put over 26 million records at risk after a threat actor group, ShinyHunters, made a ransom demand and released the data when it wasn't met. This alarming incident highlights the growing threat of data breaches and the importance of robust cybersecurity measures.
Armored Likho Exploits Global Targets with BusySnake Stealer
Meet Armored Likho, a sneaky threat actor who's been wreaking havoc globally, exploiting both private individuals and organizations, including government agencies and electric power sectors in Russia, Brazil, and Kazakhstan. With a blend of financially motivated attacks and targeted cyber espionage, Armored Likho is a force to be reckoned with.
ScreenConnect Exploited in Large-Scale Campaign Disguised as Freeware
Cybercriminals have launched a massive campaign disguising a malicious ScreenConnect installer as freeware, tricking users into downloading it from over 90 fake websites in 10 languages. The scam starts with a bogus OBS Studio download that secretly installs the ScreenConnect utility, ultimately delivering a nasty AsyncRAT payload.
PCPJack Hijacks Cloud Servers for Covert SMTP Relay Network
Security firm Hunt.io uncovered a sneaky operation where hackers known as PCPJack hijacked cloud servers worldwide, turning them into secret SMTP relays that pumped out spam every five minutes. The stolen servers, found in major cloud platforms like AWS, Google Cloud, and Azure, were quietly converted into spam-spewing machines.
Threat Actor Leverages AI to Craft EDR Evasion Tools
Sophos X-Ops stumbled upon a secret laboratory while investigating a routine endpoint alert, uncovering a trove of AI-powered tools designed to sneak past modern EDR agents. The surprising discovery revealed a sophisticated operation using partly AI-generated Python scripts to craft evasive tools.
GitHub Tags Exploited to Deploy Credential-Stealing Malware
Malicious actors have manipulated hundreds of GitHub tags to spread credential-stealing malware through popular Laravel Lang localization packages, putting countless users at risk. By rewriting historical tags, attackers tricked Composer installations into downloading the malicious payload.
GitHub Breach Exposes 3,800 Repositories via Malicious VS Code Extension
GitHub's security chief confirms that customer data remains safe, with no evidence of impact outside of GitHub's internal repositories. The breach originated from a poisoned VS Code extension installed on a compromised employee device, allowing attackers to steal credentials.
GitHub Breach Exposes 3,800 Internal Repositories
GitHub has confirmed a significant breach, revealing that hackers made off with approximately 3,800 internal repositories after a developer fell victim to a poisoned VS Code script. Fortunately, the company assures that customer data appears to be safe, and the incident seems to be contained within GitHub's internal systems.
GitHub Hit by Internal Repo Breach via Malicious VS Code Extension
GitHub's internal repositories were breached after a malicious Visual Studio Code extension was used to launch the attack, but thankfully, customer data appears to be safe. The incident has left users wondering what else may have been compromised.
GitHub Breach Exposes 3,800 Repos via Malicious VSCode Extension
GitHub recently uncovered a sneaky attack involving a tainted VS Code extension that compromised an employee's device, putting 3,800 repositories at risk. The breach was quickly contained, but not before some internal repositories were exfiltrated.
GitHub Probes Breach Claim by TeamPCP Hackers
GitHub is investigating a security breach claim by hackers TeamPCP, who allegedly stole around 4,000 of the platform's internal repositories and put the source code up for sale for a hefty $50,000. The company has already sprung into action, detecting and containing the breach and taking steps to mitigate the risk.
Social Engineering Tactics Expose Company's Vulnerability
A simple request from "the boss" was all it took for a threat actor to gain root access to a company's system, exposing a shocking vulnerability in their security - one that was exploited through a clever social engineering tactic. Human IT managers, trying to be helpful, inadvertently handed over the keys to the kingdom.
Ransomware Negotiator Exposed as Insider for Gang
A shocking case reveals a glaring weakness in ransomware incident response: organizations often put blind trust in single negotiators, leaving them vulnerable to exploitation by attackers. This human error, not a technical bug, can turn a trusted role into a gateway for cybercriminals.