Recently, Check Point Research observed threat actors using GitHub to achieve initial infections by utilizing new methods.
Previously, GitHub was used to distribute malicious software directly, with a malicious script downloading either raw encrypted scripting code or malicious executables. Their tactics have now changed and evolved. Threat actors now operate a network of “Ghost” accounts that distribute malware via malicious links on their repositories and encrypted archives as releases. This network not only distributes malware but also provides various other activities that make these “Ghost” accounts appear as normal users.
Read more…
Source: Check Point
Related:
- Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat
October 28, 2026
GMO warned customers to back up data, disconnect devices, and shut down systems after a cyberattack. Attackers allegedly stole customer data, leaked information, and threatened ransomware deployment. Compromised trading-platform credentials and reports of unauthorized transactions raised concerns for affected users. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The latest cyber security news and insights delivered ...
- Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
October 28, 2026
Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online after a hacker stole reams of data in a previously undisclosed breach at the government department earlier this year. The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, ...
- Rogue AI agent engages ‘Skynet mode’ to search the internet for exposed LLMs to hijack and run malware attacks
October 26, 2026
Researchers uncovered an autonomous AI attack campaign that hijacks exposed AI agents and infrastructure. The malicious “Skynet” agent deployed cryptominers, stole credentials, and recruited new AI systems autonomously. Security teams are urged to secure AI endpoints, restrict permissions, and protect high-value API keys. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The latest cyber security news ...
- Patient records exposed in Quest breach
October 26, 2026
Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records. Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from routine laboratory testing to specialized testing in ...
- Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
October 22, 2026
The bad week for cybersecurity just got worse for thousands more companies, who were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise. Security researchers at Microsoft say the China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials that are used to establish data links ...
- Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline
October 19, 2026
Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. “Ahold Delhaize is experiencing a security issue within its network,” ...