Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
Cybersecurity researchers at Huntress have identified an intrusion where an unknown threat actor used a suspected AI-generated PowerShell script to enumerate Active…
Tag: CI/CD
FBI Advisory on TeamPCP Supply Chain Attacks
The FBI issued an advisory on July 2, 2026, warning organizations about the persistent risk from exfiltrated data and credentials. It recommended…
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
Cybersecurity researchers have flagged a new evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family,…
GitHub to Disable npm Install Scripts by Default to Combat Supply Chain Attacks
GitHub has announced significant security changes for npm version 12, set to release next month, aimed at mitigating software supply chain attacks.…
StepSecurity Analysis of Affected Platforms
StepSecurity analyzed the CloudSEK dataset and found GitLab was the most affected platform with 1,064 organizations, followed by GitHub Actions, Azure DevOps,…
JetBrains: Developer Tools and TeamCity Vendor
JetBrains is a software company known for developer tools and the TeamCity CI/CD server. It patched CVE-2026-63077 and provided guidance for on-premise…
Hudson Rock Attributes CI Runner Dumps to TeamPCP
Hudson Rock attributed 118,829 CI runner dumps to 2,488 corporate domains from a 153GB archive of TeamPCP's exfiltrated data.
actions/checkout: GitHub Action for Repository Checkout
actions/checkout is the official GitHub action for checking out a repository into the workflow runner. It was updated to block common pwn…
GitHub Actions Used in Supply Chain Attack
GitHub Actions was one of the distribution ecosystems used by TeamPCP to push poisoned versions of open-source projects.
CloudSEK Analysis of TeamPCP Exposure
CloudSEK reconstructed the exposure from TeamPCP's campaign, estimating over 2,500 organizations and 434,000 CI/CD pipelines. It noted that credential theft does not…