Claude Code secrets exposure affected 1,994 GitHub repositories. Learn how approval settings leaked credentials and what security teams should do next.

Fake GitHub security tools spread malware through deceptive repositories. Learn how the campaign works, warning signs, and steps to protect your team.

At a Glance Actor or Group Kimsuky (suspected North Korean state-sponsored group, also tracked as TA406 and APT43) Activity Type Spear-phishing, living-off-the-land AnyDesk staging, GitHub Pages hosting, and credential harvesting Targets or Victims Ukrainian diplomatic and defense specialists, South Korean citizens, and German commercial targets Scale

TL;DR Check Point Research uncovered a Yoba malware campaign that uses fake GitHub repositories and search engine optimization poisoning to impersonate ChatGPT and Claude desktop apps. Inside the downloaded archives, the GitHub Yoba malware campaign pairs legitimate, digitally signed executables from OpenAI and Anthropic with a malicious library named YobaDropper. Once executed, the chain sideloads a second-stage downloader called YobaLoader that fetches instructions via Telegram and Google DNS-over-HTTPS to inject an XMRig cryptocurrency miner.

TL;DR Check Point Research uncovered a Yoba malware campaign that uses fake GitHub repositories and search engine optimization poisoning to impersonate ChatGPT and Claude desktop apps. Inside the downloaded archives, the GitHub Yoba malware campaign pairs legitimate, digitally signed executables from OpenAI and Anthropic with a malicious library named YobaDropper. Once executed, the chain sideloads a second-stage downloader called YobaLoader that fetches instructions via Telegram and Google DNS-over-HTTPS to inject an XMRig cryptocurrency miner.

At a Glance Attribute Details Organization Multiple entities (including the US CDC, BuildBuddy, and Civica) Data Exposed GitHub App RSA private keys, repository access, administrative permissions Number Affected 474 valid keys across 440 distinct Apps; hundreds of organizations exposed Cause Cryptographic private keys committed into public and third-party repositories Disclosure Status

GitHub expands security tools after 39M secret leaks in 2024. #GitHubSecurity #DevSecOps #Cybersecurity

GitVenom campaign uses fake GitHub repos to spread malware; exercise caution. #GitVenom #GitHubSecurity #Cybersecurity

A single line of code could allow hackers to breach MITRE and Splunk

A global malware campaign has misused GitHub repositories to infect nearly one million devices, exploiting trust signals and redirecting users from illegal streaming sites.

GitHub fixed a critical vulnerability, CVE-2026-3854, affecting both cloud and on-premises GitHub Enterprise Server that allowed improper handling of git push options. An authenticated user with write permissions could inject delimiter-separated values (e.g., rails_env=nonprod) into internal metadata to achieve server-side command execution; administrators must upgrade affected GHES releases and inspect logs for anomalous push parameters. #CVE-2026-3854 #GitHubEnterpriseServer

CVE-2026-9312 is a CWE-918 SSRF vulnerability affecting GitHub Enterprise Server before version 3.22. The flaw arises from insufficient input validation in an upload endpoint, allowing unauthenticated attackers to inject path traversal sequ

PraisonAI (versions ≤ 4.5.139) uses GitHub Actions workflows that improperly handle credentials by not disabling persistence of GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN during checkout. This results in these tokens being stored in .git/config

The reported critical vulnerability in OpenAI Codex involves a security flaw that could be exploited to compromise GitHub tokens. OpenAI Codex is an AI-powered code generation tool that integrates with development environments and platforms

Researchers from Cisco’s Talos security team have uncovered a malware-as-a-service operator that used public GitHub accounts as a channel for distributing an assortment of malicious software to targets....

A flaw in Puppet Forge on GitHub could have led to a supply chain disaster matching the scope of the attack on SolarWinds. Here are the ke...

Instead of echoing your secrets in your actions use the official Github Google Cloud Action