Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.
← Thèmes
📦
Code & dépendances
Paquets piégés, dépendances à risque, fins de support : ce que ça change pour votre code, et quoi faire.
75 articles
S’abonner (RSS)Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code.
New Carbonato malware uses AI agents to hijack exposed Docker hosts
CARBONATO exploits exposed Docker daemons, installs an AI agent, steals API keys and spreads across networks with autonomous command execution.
A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports.
An undercover Google analyst infiltrated a notorious supply-chain hacking gang
📡 TeamPCP : Google infiltre le gang et sabote ses cyberattaques Un analyste de Google a infiltré le groupe TeamPCP pour neutraliser des attaques contre la chaîne d'approvisionnement et faire arrêter ses membres clés.
Malicious npm packages evade install-script defenses at runtime
The malicious indexed-btree package has reached 2 million weekly downloads in a new NPM supply chain attack.
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
Threat actors stole 170 private repositories using an OAuth token stolen from a former employee's computer through the TanStack npm supply chain attack.
PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting
CrowdStrike says PhantomRaven was likely LLM-generated and spread through malicious npm packages that collect developer credentials and CI/CD secrets.
Brevo supply-chain attack injected ClickFix scripts on customer sites
A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.
Our framework for reporting model misalignment
OpenAI launches a formal framework to disclose model misalignment, publishing six reports on models that lied, faked data, or bypassed rules.
OpenAI agents carried out an undisclosed attack on RubyGems
Researchers believe OpenAI agents were responsible for the May attack that forced RubyGems maintainers to suspend new account registrations.
OpenAI agents attacked RubyGems back in May
A report links OpenAI agents to a RubyGems campaign that abused RubyDoc for RCE and published more than 2,000 packages in May.
Windows 11 : Microsoft parie sur le vibe coding pour développer les apps WinUI
Pour fabriquer une application Windows native, le passage par Visual Studio était jusqu'ici la voie normale. Mais c'était sans compter sur Microsoft qui a publié winapp , un outil en ligne de commande qui permet de faire tout pareil directement depuis un terminal : il crée le projet, le construit...
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
In one attack, threat actors stole an API key that ultimately led to the consumption of $600,000 in public AI model credits for the security nonprofit.
Two individuals behind TeamPCP were apprehended today in Australia. TeamPCP was the Threat Group...
The group infected more than 1,000 organizations in a relentless supply-chain attack campaign.
Australia Arrests 2 Alleged TeamPCP Hackers
The arrests come after a wave of cyberattacks earlier this year targeting tech companies that rely on high-profile and widely used open source software.
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.
Rust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat
North Korean hackers compromised the popular arrayref package in a supply chain attack targeting the Rust ecosystem.
Supply chain attack on arrayref (Rust blog)
L’équipe Rust a signalé jeudi une attaque visant un crate très populaire, arrayref. Elle a permis, pendant un peu plus d’une heure, de distribuer des…
Terabytes of credentials leaked in massive supply-chain attack
Stolen credentials tied to the LiteLLM breach have surfaced in a 153GB archive linked to thousands of corporate domains.
How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM
95% of the 2,500 organizations supposedly affected by the LiteLLM supply chain attack were exposed by the Trivy hack.
BdThemes plugins supply-chain hack creates rogue WordPress admins
BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell without plugin updates.
Phishing Campaign Leveraging the NPM Ecosystem
Nearly 800 malicious npm packages deliver a cross-platform RAT and infostealer, using WEL1DROPPER to target Windows, macOS, and Linux systems.