GhostAction used a GitHub lookalike to phish a maintainer, capture credentials, and automate OAuth device authorization for repository and workflow access. A victim was stopped by an additional MFA challenge; successful token theft was not confirmed.
GhostAction attackers injected GitHub Actions workflows to steal secrets and scan repository history. A new wave affected 346 repositories; researchers validated 790 repositories overall. my-github[.]com is linked to the collector IP, but operator attribution remains un
The episode analyzes a compromised Tensorlake npm SDK, a fake interview repo that redirects installs through an npm mirror, and 42 malicious RubyGems packages targeting crypto developers.
A guide explains how to investigate Git history tampering linked to the PolinRider campaign by comparing commit metadata with server-side push records and registry timestamps. Its case study found the npm package remained clean.
Researchers identified 42 malicious RubyGems packages that use reverse shells or a toolkit to hijack cryptocurrency transactions and steal wallet data. The article details the malware’s delivery, persistence, and operation.
The episode covers arrests linked to ShinyHunters and KillSec, a $351.6 million Bitget theft attributed to suspected North Korean hackers, signed Mac malware posing as Claude Desktop, malicious Baileys packages and PolinRider evasion changes.
Researchers traced PolinRider across three development repositories, documenting changing payload names, paths, and extensions, plus repeated force-pushes that restored malware after cleanup. They say the variants appear to be tested in parallel.
The episode covers ShinyHunters’ claimed FBI data theft, malicious Baileys packages, WeaselBiscuit malware, advisories and research on DPRK campaigns, and attacks exploiting developer workflows.
Researchers analyzed WeaselBiscuit, a staged Node.js infostealer found in malicious npm packages. It steals Chrome extension data and can collect clipboard contents and Windows keystrokes; links to DPRK actors remain unconfirmed.