Security firm Socket has uncovered "Operation Muck and Load" — a campaign using 222 GitHub repositories across 190 accounts to distribute Windows malware. Active since January 24, 2026, the threat actor published over 1,200 package versions, 700 of which are malicious.
The attack disguises a Go module as a legitimate DNS scanning tool, impersonating the real open source project dnsub. Hidden PowerShell code then pulls encrypted payloads from dead-drop platforms including Pastebin, YouTube, Instagram, Telegram, and Google Docs — making it harder to shut down.
Final payloads include AsyncRAT, Quasar RAT, Vidar infostealer, and XMRig cryptominers. Anyone who has pulled a DNS or subdomain scanning module from GitHub should check what they actually installed — go.mod and go.sum are the place to start.
Source: SecurityWeek
Security firm Socket has uncovered "Operation Muck and Load" — a campaign using 222 GitHub repositories across 190 accounts to distribute Windows malware. Active since January 24, 2026, the threat actor published over 1,200 package versions, 700 of which are malicious.
The attack disguises a Go module as a legitimate DNS scanning tool, impersonating the real open source project dnsub. Hidden PowerShell code then pulls encrypted payloads from dead-drop platforms including Pastebin, YouTube, Instagram, Telegram, and Google Docs — making it harder to shut down.
Final payloads include AsyncRAT, Quasar RAT, Vidar infostealer, and XMRig cryptominers. Anyone who has pulled a DNS or subdomain scanning module from GitHub should check what they actually installed — go.mod and go.sum are the place to start.
Source: SecurityWeek
Accenture has confirmed a security incident after a hacker posted on PwnForums claiming to have stolen 35 gigabytes of internal data — including Azure access keys, tokens, SSH and RSA keys, configuration files, and source code. The threat actor posted a screenshot of a private Azure DevOps repository on an accenture.com domain as proof, and listed the data for sale.
Accenture called it "this isolated matter," said it had "remediated its source," and reported no impact to operations or service delivery. It did not confirm what was taken, whether personal or client data was involved, or how the attacker got in.
Ross Filipek, CISO at Corsica Technologies, warns the stolen data could serve as "a playbook for future attacks" — exposing code vulnerabilities, credentials and infrastructure detail. Consulting firms make attractive targets precisely because of how deep their access runs into client systems.
Source: SecurityWeek
Accenture has confirmed a security incident after a hacker posted on PwnForums claiming to have stolen 35 gigabytes of internal data — including Azure access keys, tokens, SSH and RSA keys, configuration files, and source code. The threat actor posted a screenshot of a private Azure DevOps repository on an accenture.com domain as proof, and listed the data for sale.
Accenture called it "this isolated matter," said it had "remediated its source," and reported no impact to operations or service delivery. It did not confirm what was taken, whether personal or client data was involved, or how the attacker got in.
Ross Filipek, CISO at Corsica Technologies, warns the stolen data could serve as "a playbook for future attacks" — exposing code vulnerabilities, credentials and infrastructure detail. Consulting firms make attractive targets precisely because of how deep their access runs into client systems.
Source: SecurityWeek
A massive global cybercrime sweep has wrapped up with 5,811 arrests and $293 million in intercepted illicit assets. Operation First Light 2026 ran from January 15 to April 30, 2026, pulling in law enforcement from 97 countries under Interpol's coordination — with funding from China's Ministry of Public Security.
The operation targeted social engineering scams like romance fraud and business email compromise schemes. Authorities blocked or froze 31,014 bank accounts, seized cryptocurrency wallets, identified 15,606 suspects, and uncovered more than 142,000 victims worldwide.
One standout bust in Eswatini took down a network posing as Brazilian Federal Police over video calls, talking victims into transferring money for "safekeeping." Officers seized 240 electronic devices and a full replica Brazilian police station — fake uniforms, signage and all.
Source: Infosecurity Magazine
A massive global cybercrime sweep has wrapped up with 5,811 arrests and $293 million in intercepted illicit assets. Operation First Light 2026 ran from January 15 to April 30, 2026, pulling in law enforcement from 97 countries under Interpol's coordination — with funding from China's Ministry of Public Security.
The operation targeted social engineering scams like romance fraud and business email compromise schemes. Authorities blocked or froze 31,014 bank accounts, seized cryptocurrency wallets, identified 15,606 suspects, and uncovered more than 142,000 victims worldwide.
One standout bust in Eswatini took down a network posing as Brazilian Federal Police over video calls, talking victims into transferring money for "safekeeping." Officers seized 240 electronic devices and a full replica Brazilian police station — fake uniforms, signage and all.
Source: Infosecurity Magazine
A sophisticated phishing campaign is targeting marketing professionals by impersonating major brands including Coca-Cola, Netflix, OpenAI, McKinsey & Company, Louis Vuitton and FIFA. First spotted by Team Cymru's Will Thomas, the attackers send personalized job recruitment emails via legitimate HR platform PeopleForce, then route victims through nested redirects — bouncing through Salesforce's ExactTarget and real estate CRM Wise Agent — before landing on a fake Google sign-in page hosted on Netlify.
The multi-hop redirect chain bypasses basic email filters and builds false trust. Over 30 malicious domains have been identified, on convincing addresses like mckinsey-careers[.]com.
The final page uses a browser-in-the-browser trick: the Google login window is drawn inside the web page rather than being a real browser window. That's the tell — a genuine login window can be dragged outside the page, and a fake one can't. Password managers help too, since they won't autofill on a spoofed domain. Advanced web filtering and social engineering training round out the defenses.
Source: Dark Reading
A sophisticated phishing campaign is targeting marketing professionals by impersonating major brands including Coca-Cola, Netflix, OpenAI, McKinsey & Company, Louis Vuitton and FIFA. First spotted by Team Cymru's Will Thomas, the attackers send personalized job recruitment emails via legitimate HR platform PeopleForce, then route victims through nested redirects — bouncing through Salesforce's ExactTarget and real estate CRM Wise Agent — before landing on a fake Google sign-in page hosted on Netlify.
The multi-hop redirect chain bypasses basic email filters and builds false trust. Over 30 malicious domains have been identified, on convincing addresses like mckinsey-careers[.]com.
The final page uses a browser-in-the-browser trick: the Google login window is drawn inside the web page rather than being a real browser window. That's the tell — a genuine login window can be dragged outside the page, and a fake one can't. Password managers help too, since they won't autofill on a spoofed domain. Advanced web filtering and social engineering training round out the defenses.
Source: Dark Reading
Cybersecurity firm Sysdig has documented what it calls the first agentic ransomware attack — where an AI agent autonomously ran an entire extortion operation, from reconnaissance and credential theft through lateral movement, encryption, data destruction and the ransom note. The late June 2026 attack, attributed to a financially motivated group called JadePuffer, exploited Langflow flaw CVE-2025-3248 to reach a MySQL and Alibaba Nacos production server.
The agent ran over 600 payloads, self-corrected an error in 31 seconds, and tapped models from OpenAI, Anthropic, DeepSeek and Gemini.
The autonomy had limits worth noting. A human provisioned the infrastructure, configured the command-and-control server, picked the victim, and supplied root credentials obtained in an earlier compromise — the agent took it from there.
"The skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent," warned Michael Clark, Sysdig's senior director of threat research. Anyone running Langflow should confirm CVE-2025-3248 is patched.
Source: CyberScoop
Cybersecurity firm Sysdig has documented what it calls the first agentic ransomware attack — where an AI agent autonomously ran an entire extortion operation, from reconnaissance and credential theft through lateral movement, encryption, data destruction and the ransom note. The late June 2026 attack, attributed to a financially motivated group called JadePuffer, exploited Langflow flaw CVE-2025-3248 to reach a MySQL and Alibaba Nacos production server.
The agent ran over 600 payloads, self-corrected an error in 31 seconds, and tapped models from OpenAI, Anthropic, DeepSeek and Gemini.
The autonomy had limits worth noting. A human provisioned the infrastructure, configured the command-and-control server, picked the victim, and supplied root credentials obtained in an earlier compromise — the agent took it from there.
"The skill floor for running a full ransomware operation just dropped to whatever it costs to run an agent," warned Michael Clark, Sysdig's senior director of threat research. Anyone running Langflow should confirm CVE-2025-3248 is patched.
Source: CyberScoop
Security researchers at Push Security have uncovered a "poisoned tenant" attack where hackers create fake OpenAI organizations — impersonating real companies — and send employees legitimate-looking invitations straight from OpenAI's own notification system, noreply@tm.openai.com. One click joins the victim to an attacker-controlled tenant with zero additional verification.
Once inside, anything the employee does — prompts, uploaded files, API calls — is visible to the attacker. The fake orgs go to some lengths to look real: executive impersonation, Owner-level privileges for everyone, even a credit card attached to avoid friction on paid features. Push found the technique when it saw itself impersonated, and the invites observed so far have targeted cybersecurity and tech firms.
No spoofed domains, no malicious links. Just a trusted platform being weaponized against its own users. The one visible tell is a small domain mismatch warning on the invite. Beyond that, defences are organizational: restrict who can join external tenants, enforce domain verification, and get visibility into which SaaS orgs staff are actually joining.
Source: Cybersecurity News
Security researchers at Push Security have uncovered a "poisoned tenant" attack where hackers create fake OpenAI organizations — impersonating real companies — and send employees legitimate-looking invitations straight from OpenAI's own notification system, noreply@tm.openai.com. One click joins the victim to an attacker-controlled tenant with zero additional verification.
Once inside, anything the employee does — prompts, uploaded files, API calls — is visible to the attacker. The fake orgs go to some lengths to look real: executive impersonation, Owner-level privileges for everyone, even a credit card attached to avoid friction on paid features. Push found the technique when it saw itself impersonated, and the invites observed so far have targeted cybersecurity and tech firms.
No spoofed domains, no malicious links. Just a trusted platform being weaponized against its own users. The one visible tell is a small domain mismatch warning on the invite. Beyond that, defences are organizational: restrict who can join external tenants, enforce domain verification, and get visibility into which SaaS orgs staff are actually joining.
Source: Cybersecurity News
Kaspersky has documented a new weapon in the hands of Armored Likho, a threat group it has tracked before: a previously undocumented, Python-based infostealer called "BusySnake." The group is targeting government agencies and electrical power entities across Russia, Brazil and Kazakhstan with spear-phishing emails disguised as official government or social assistance communications.
BusySnake steals browser passwords and cookies, clipboard contents, cryptographic keys, and Telegram session data, and opens backdoor access through reverse SSH tunnels and remote-access software. It consolidates into one tool what the group previously ran as separate components, including its Go2Tunnel utility.
Kaspersky also sees the group leaning on AI to build its first-stage loaders — inferred from redundant comments and code blocks atypical of human developers, rather than from any recovered tooling. The group's nation-state affiliation remains unconfirmed.
Source: Dark Reading
Kaspersky has documented a new weapon in the hands of Armored Likho, a threat group it has tracked before: a previously undocumented, Python-based infostealer called "BusySnake." The group is targeting government agencies and electrical power entities across Russia, Brazil and Kazakhstan with spear-phishing emails disguised as official government or social assistance communications.
BusySnake steals browser passwords and cookies, clipboard contents, cryptographic keys, and Telegram session data, and opens backdoor access through reverse SSH tunnels and remote-access software. It consolidates into one tool what the group previously ran as separate components, including its Go2Tunnel utility.
Kaspersky also sees the group leaning on AI to build its first-stage loaders — inferred from redundant comments and code blocks atypical of human developers, rather than from any recovered tooling. The group's nation-state affiliation remains unconfirmed.
Source: Dark Reading
Researchers at Socket have tracked a North Korea-linked campaign quietly compromising open source software since December 2025, which they've named PolinRider. It sits under the broader Contagious Interview operation.
The attackers hijack legitimate GitHub maintainer accounts, inject obfuscated JavaScript loaders into real repositories, and use Git history rewriting to make the changes look old. The loaders pull encrypted payloads from blockchain and public RPC infrastructure, which makes the delivery channel hard to take down. Two payloads follow: the DEV#POPPER RAT and OmniStealer.
So far, 162 malicious artifacts across 108 packages have been found on NPM, Packagist, Go modules and Chrome extensions. Any developer who installed an affected package should assume their environment is compromised — and because credentials may already be exposed, remediate from a clean machine rather than the infected host.
Source: SecurityWeek
Researchers at Socket have tracked a North Korea-linked campaign quietly compromising open source software since December 2025, which they've named PolinRider. It sits under the broader Contagious Interview operation.
The attackers hijack legitimate GitHub maintainer accounts, inject obfuscated JavaScript loaders into real repositories, and use Git history rewriting to make the changes look old. The loaders pull encrypted payloads from blockchain and public RPC infrastructure, which makes the delivery channel hard to take down. Two payloads follow: the DEV#POPPER RAT and OmniStealer.
So far, 162 malicious artifacts across 108 packages have been found on NPM, Packagist, Go modules and Chrome extensions. Any developer who installed an affected package should assume their environment is compromised — and because credentials may already be exposed, remediate from a clean machine rather than the infected host.
Source: SecurityWeek
A critical vulnerability in the LiteSpeed cPanel user-end plugin is being actively exploited, threatening shared hosting environments globally. Tracked as CVE-2026-54420, the flaw lets attackers with limited access — like stolen FTP credentials — bypass CloudLinux's CageFS isolation and escalate all the way to root, potentially exposing every site on a shared server. CISA has flagged it as actively exploited.
Namecheap researchers discovered the issue after spotting suspicious API call patterns: rapid concurrent chaining of the generateEcCert and packageUserSize functions across multiple threads.
LiteSpeed patched it on June 1, 2026 — in user-end plugin version 2.4.8 and WHM plugin version 5.3.2.1. Update both immediately, or remove the user-end plugin as a stopgap. And because exploitation started before the patch existed, review your logs for those API call patterns: updating now won't tell you whether you were already hit.
Source: Cybersecurity News
A critical vulnerability in the LiteSpeed cPanel user-end plugin is being actively exploited, threatening shared hosting environments globally. Tracked as CVE-2026-54420, the flaw lets attackers with limited access — like stolen FTP credentials — bypass CloudLinux's CageFS isolation and escalate all the way to root, potentially exposing every site on a shared server. CISA has flagged it as actively exploited.
Namecheap researchers discovered the issue after spotting suspicious API call patterns: rapid concurrent chaining of the generateEcCert and packageUserSize functions across multiple threads.
LiteSpeed patched it on June 1, 2026 — in user-end plugin version 2.4.8 and WHM plugin version 5.3.2.1. Update both immediately, or remove the user-end plugin as a stopgap. And because exploitation started before the patch existed, review your logs for those API call patterns: updating now won't tell you whether you were already hit.
Source: Cybersecurity News
A newly disclosed Linux kernel vulnerability called "Bad Epoll" (CVE-2026-46242) lets unprivileged local users gain full root access on Linux servers, desktops and Android devices. The flaw is a race condition and use-after-free in the kernel's epoll subsystem — a core component that can't be disabled without breaking the OS.
Researcher Jaeyoung Chung found and exploited the bug, submitting it to Google's kernelCTF program, which pays $71,337+ for working kernel exploits. The exploit hits roughly 99% reliability despite a race window of about six instructions, and it's reachable from inside Chrome's renderer sandbox — meaning it can be chained with a renderer exploit for full kernel code execution.
There's no evidence of exploitation in the wild, but full technical details and working exploit code are now public, so that window won't stay open. Upstream and distribution patches are available — apply them. Worth checking you're on the final fix rather than an early one: the first patch attempts were incomplete, and a correct fix only landed nearly two months after disclosure.
Source: Cybersecurity News
A newly disclosed Linux kernel vulnerability called "Bad Epoll" (CVE-2026-46242) lets unprivileged local users gain full root access on Linux servers, desktops and Android devices. The flaw is a race condition and use-after-free in the kernel's epoll subsystem — a core component that can't be disabled without breaking the OS.
Researcher Jaeyoung Chung found and exploited the bug, submitting it to Google's kernelCTF program, which pays $71,337+ for working kernel exploits. The exploit hits roughly 99% reliability despite a race window of about six instructions, and it's reachable from inside Chrome's renderer sandbox — meaning it can be chained with a renderer exploit for full kernel code execution.
There's no evidence of exploitation in the wild, but full technical details and working exploit code are now public, so that window won't stay open. Upstream and distribution patches are available — apply them. Worth checking you're on the final fix rather than an early one: the first patch attempts were incomplete, and a correct fix only landed nearly two months after disclosure.
Source: Cybersecurity News
