Product
GitHub CodeSpaces
- First Reported
- Sep 23, 2025
- Latest Reported
- Oct 20, 2026
Reported Context (2)
- Takeover*, which demonstrated a passive prompt injection chain achieving full repo takeover via GitHub Codespaces, and *AI-Induced Lateral Movement (AILM)*, which introduced the AI layer as a new pivot vector, a Orca’s 2026 AI Security Report Finds Widespread Unpatched Vulnerabilities and Exposed Credentials
- At the center of this campaign is a Python-based command-and-control (C2) framework hosted on GitHub CodeSpaces. This campaign also utilizes a Python based spreader with a multi-stage Docker deployment as the initial ShadowV2 Botnet Targets Exposed Docker Daemons and Offers DDoS-for-Hire Capabilities
CVE (4)
Malware (2)
People (2)
Threat Actors (1)
MITRE ATT&CK (7)
Vendors (9)
Products (12)
Tools (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.