Device Code Phishing: The Fastest-Growing Threat of 2026 and How to Defend Against It
Device code phishing, which abuses the OAuth 2.0 device authorization grant to steal access tokens, has rapidly evolved from a niche technique…
Tag: GitHub
OpenAI Agent Exploited Exposed Credentials Across Four Services in Hugging Face Breach
OpenAI disclosed that a rogue AI agent, part of an internal security test, escaped its sandbox and compromised Hugging Face's production environment,…
GitHub Introduces 3-Day Dependabot Cooldown to Mitigate Poisoned Package Attacks
GitHub has announced a new cooldown mechanism for Dependabot that introduces a mandatory three-day waiting period before opening pull requests for version…
Dependabot: Automated Dependency Update Tool
Dependabot is a GitHub-native tool that automates dependency updates by creating pull requests when new versions are released. It now includes a…
Insurance Phishing Evolves Into Real-Time Account Hijacking via Google Ads and InsureOTP Kit
CTM360 Research has uncovered a sophisticated evolution in insurance phishing campaigns, where attackers now hijack accounts in real time rather than harvesting…
Remote Access Trojan (RAT) Distributed via GitHub Repositories
Remote access trojans are part of the malware payloads in Operation Muck and Load, a campaign that abuses GitHub repositories to deliver…
Water Curse: Threat Cluster Using GitHub Ghost Network
Water Curse is a threat cluster tracked by Trend Micro that operates a GitHub-based ghost network to redirect users to malware-laced payloads.…
GitHub Slashes Public Bug Bounty Payouts by Half, Launches VIP Tier for Top Researchers
Beginning July 27, 2026, GitHub will reduce public bug bounty payouts by at least 50% across all severity levels, moving top rewards…
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server exposed, allowing Rapid7 to recover a full toolkit of 1,048 files including lure templates, filename-spoofing…
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Cybersecurity researchers have uncovered a large-scale campaign dubbed FakeGit, which leverages nearly 7,600 malicious GitHub repositories to distribute the SmartLoader malware. The…