LastPass discovers new infostealer variant disguised as GitHub repo

Fake GitHub repositories are used to lure victims into downloading. An infostealer uses signatures from Microsoft’s Hardware Compatibility Program.

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel.
cybernews

10,000 malicious GitHub repos detected: AI agents compromising their owners

Developers on GitHub are finding their projects cloned by the thousands. Hackers slip trojans into fake repos and wait for a sleepy developer or a gullible AI agent to download one. So far, 10,000 ...
BleepingComputer

GitHub disables Microsoft repos pushing password-stealing malware

Microsoft removed 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub, disrupting continuous integration pipelines. The incident occurred on June 5, ...