Cybersecurity & Data Protection
0
UPVOTE
thehackernews.com

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
TN

The Hacker News

1h ago
0 0

Discussion

Begin the discussion

Begin something meaningful by sharing your ideas.

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

No upvotes yet.

Be the first to show your appreciation for this content.

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

bleepingcomputer.com
Inside the Underground Market for Know Your Client Services

Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flar…
MB

Maria Bakker

2026-10-19 16:09
0
thehackernews.com
Fake Web3 Accelerator Uses npm Packages to Spread Malware and H…

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretex…
TN

The Hacker News

2h ago
0
bleepingcomputer.com
Hackers exploit SiteGuard WAF flaw to run commands as admins

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers…
Golden Greta

Golden Greta

20h ago
0
thehackernews.com
ConnectWise Suspends Cloud Backup After Attackers Compromise Mi…

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threa…
Thanakorn Boon

Thanakorn Boon

1d ago
0
bleepingcomputer.com
Hackers breach Microsoft 365 tenants via ConnectWise supply-cha…

ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and comprom…
MA

maya af

1d ago
0
thehackernews.com
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Window…

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The…
TN

The Hacker News

2d ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Cybersecurity & Data Protection.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

thehackernews.com
Fake Web3 Accelerator Uses npm Packages to Spread Malware and H…

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretex…
TN

The Hacker News

2h ago
0
thehackernews.com
ConnectWise Suspends Cloud Backup After Attackers Compromise Mi…

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threa…
Thanakorn Boon

Thanakorn Boon

1d ago
0
thehackernews.com
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Window…

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The…
TN

The Hacker News

2d ago
0
thehackernews.com
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-O…

A local privilege escalation exploit published today gains root on OpenBSD 7. 9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw,…
TN

The Hacker News

2d ago
0
thehackernews.com
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Ove…

The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remo…
TN

The Hacker News

3d ago
0
thehackernews.com
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Re…

A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstra…
Golden Greta

Golden Greta

3d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest