Malware | Breaking Cybersecurity News | The Hacker News

Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected those credentials, the company says. Each attack started with a pull request titled docs: dependency audit notes, opened from a branch named wfx-docs to test whether the account could write to the repository. These test pull requests were opened in 61,764 repositories, and the stealer followed in some of them. In a separate analysis , researchers at SafeDep, which sells software supply chain security tools, counted 8,093 repositories that received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC today. That count covers every repository that received malicious commits, no...

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access . In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments," it said . "We are continuing to validate this assessment. The initial access method and full scope remain under investigation." ConnectWise has identified about 400 partner environments with at least one of the third-party extensions installed. It also emphasized that the presence of the extensions alone does not indicate or establish compromise. While these extensions provide an API capable of executing remote commands, access to that API is secured by a passphrase c...

Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some level of overlap with a November 2023 campaign documented by Arctic Wolf in which threat actors linked to the CACTUS ransomware operation likely weaponized then-newly-disclosed flaws in Qlik Sense to obtain initial access to target environments. The vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows -

Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery , OceanGate , and DarkWire . Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow. The entity behind the Sparrow framework has been codenamed CopperDragon , and is assessed to be a digital quartermaster developing tools for China-nexus threat actors, including FamousSparrow , Earth Estries , Tropic Trooper , UAT-9244 , and UAT-8302 . "Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing inf...

Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two vulnerabilities were released by Ahsay Backup in mid-October 2026. The two vulnerabilities are assessed to have been weaponized as zero-days, with the managed security platform first observing threat actors employing a smash-and-grab approach to deploy web shells and XMRig cryptocurrency miners on compromised systems. "However, this incident reflects a much larger intrusion with more patience; the operator planted shells in several places, ran two different miners, staged tunneling tools, and installed a custom implant, all on servers whose job is to hold backups," Huntress rese...