Gheist Campaign Steals GitHub Secrets via Stolen Tokens and Actions Logs
The Gheist group exploits stolen GitHub tokens to extract private repository secrets from GitHub Actions logs, impacting private and Enterprise GitHub environments.
Tag
#Threat Actor
10 results in the archive.
Chinese State-linked Hackers Use Automated Tools and Manual Exploits to Steal Data
Chinese government-linked threat actors exploit Microsoft Exchange vulnerabilities using automated scanning and manual methods to steal data from global targets including US critical infrastructure.
Australia Arrests Suspected TeamPCP Hackers Behind Supply Chain Attacks
Australian authorities arrested two men linked to the TeamPCP group known for extensive developer supply chain attacks, disrupting a significant threat actor.
Attackers Use Dormant GitHub Accounts to Map Corporate Orgs
Datadog Security Labs warns of campaigns using dormant GitHub accounts and compromised OAuth tokens to scrape corporate GitHub organizations and user data through the GitHub API. Attackers automate scraping with custom or legitimate-sounding user agents to blend in and avoid detection.
Hackers Use Fake Microsoft Entra Passkey Enrollment to Target M365 Users
A threat actor known as O-UNC-066 is using a phishing kit to exploit Microsoft 365 users via fake Entra passkey enrollment requests, aiming at data extortion. This tactic spans multiple industry sectors and involves voice-based social engineering.
China-linked Hackers Exploit Roundcube Flaw to Target Academic Researchers
A China-linked threat actor is exploiting a vulnerability in Roundcube webmail servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware. This campaign specifically targets academic researchers to gather intelligence.
China-Linked UAT-7810 Expands ORB Network with New LONGLEASH Malware
The Chinese APT actor UAT-7810 is enhancing its ORB network via a new LONGLEASH malware targeting internet-facing networking devices, according to Cisco Talos. This campaign builds on the previously identified LapDogs ORB infrastructure active since mid-2025.
China-Linked Hackers Use Fake Indian Tax Tool to Deploy DcRAT
A China-nexus threat group is targeting Indian taxpayers and finance teams with spear-phishing emails impersonating the Income Tax Department to deploy DcRAT, a remote access trojan. This multi-stage campaign aims to steal sensitive data from compromised systems.
Iran-Linked Hackers Deploy New Cavern C2 Framework Against Israeli Targets
An Iran-linked hacker group associated with MOIS has started using a new modular command-and-control framework called Cavern to target Israeli IT providers and government organizations. This activity has been tracked by Check Point Research and highlights evolving state-sponsored cyber threats.
North Korean Hackers Deploy 108 Malicious Packages in PolinRider Campaign
North Korean hackers linked to the Contagious Interview campaign have published 108 malicious packages and browser extensions across multiple platforms as part of their ongoing PolinRider operation. These malicious artifacts are being actively distributed via compromised maintainer accounts on npm, Packagist, Go, and Chrome Web Store.