Security startup SafeDep uncovered the Megalodon campaign, which added malicious GitHub Actions workflows to over 5,500 repositories in a six‑hour window, exfiltrating cloud credentials, SSH keys and other secrets. The attack uses dummy accounts and backdoor triggers that stay dormant until activated via the GitHub API, highlighting the growing supply‑chain threat.
Microsoft Defender experts discovered an active cryptojacking campaign that uses AI chatbot responses and poisoned search results to recommend fake system‑utility downloads. The malicious links impersonate tools like CrystalDiskInfo and HWMonitor, directing victims, especially those with high‑end GPUs, to miner payloads and persistent remote‑access implants. Organizations should enable cloud‑delivered protection and EDR block mode.
Microsoft’s Digital Crimes Unit disrupted Fox Tempest, a malware-signing-as-a-service that abused Azure Artifact Signing to issue over 1,000 fraudulent code‑signing certificates, facilitating ransomware groups like Rhysida. The takedown revokes the certificates and disrupts infrastructure, mitigating widespread attacks across sectors.
Canadian authorities detained 23‑year‑old Jacob ‘Dort’ Butler, the alleged creator of the Kimwolf IoT botnet that harnessed millions of devices for record‑breaking DDoS attacks up to 30 Tbps. He now faces criminal hacking charges in both Canada and the United States.
You’re caught up.
That was all 4 stories in the 28 May issue.