Fake "Security Audit" Workflows Sweep GitHub for Cloud and AI Keys

A credential-stealing GitHub Actions workflow disguised as a security audit has been pushed into tens of thousands of repositories from more than 500 maintainer accounts since 7 October. Two edge products are under attack as well — one patched three days before exploitation started, the other still unpatched in its current release.

Supply Chain & CI/CD

• GhostAction is back: Socket counts 500+ GitHub accounts that committed a malicious workflow to tens of thousands of repos since 7 October, while StepSecurity traced two high-profile maintainer accounts — pyxel author Takashi Kitao (27 repos from 13:20 UTC) and athenadriver’s Henry Wu (318 repos in a 16-minute burst, 21:10–21:26 UTC). The workflow (security-audit.yml / github_actions_security.yml) triggers on any push or tag, checks out with fetch-depth: 0, and curls named Actions secrets plus AWS, Anthropic, OpenAI, OpenRouter, GitHub and GitLab keys found anywhere in working tree or git history to 193.32.204[.]199 over plain HTTP. Initial access is assessed as leaked PATs from infostealer logs; the 2025 round exfiltrated 3,325 secrets from 817 repos across 327 users (The Hacker News).
• Suspected TraderTraitor actors trojanized a Terraform provider to deliver cross-platform malware, per Zscaler ThreatLabz — though @malwrhunterteam disputes the “we uncovered it in July” framing, noting others had the sample publicly at the time.

Exploitation in the Wild

• SonicWall SMA1000 CVE-2026-102255 (CVSS 10.0) is being hit three days after the patch (earlier coverage). Previdian’s honeypots logged crafted OPTIONS requests against the WorkPlace Extraweb interface reaching the appliance’s internal CouchDB on 127.0.0.1:5984, traversing into a design document’s _rewrite function with an admin:admin Basic auth header. Ryan Dewhurst stresses it is not yet established whether the attempts would have compromised anything, and SonicWall has not flagged the flaw as exploited; Shadowserver sees 400+ SMA1000 appliances exposed (BleepingComputer).
• AhsayCBS: the “fixed” version isn’t. Huntress now says Ahsay 10.3.4, the current latest build, is still vulnerable to CVE-2026-105133 (auth bypass, public exploit) and CVE-2026-105134 (command injection), so the chain remains unpatched (earlier coverage). Attacks from 7 October across at least five customer environments dropped JSP webshells and XMRig disguised as edge.exe, persisted via a MicrosoftEdgeUpdateSvc service running a renamed NSSM, and used what Huntress believes is an AI-assisted PowerShell script that halts mining when Task Manager opens and kills it at 18:00 or after an hour overnight; one host also got the vulnerable WinRing0x64.sys driver. IoCs and four Sigma rules are published (BleepingComputer, Huntress).

Public Exploits & Vulnerability Research

• Working pre-auth RCE exploit published for AnyDesk on Linux, giving root before anyone accepts the connection. AnyDesk fixed it in 8.0.3 back in June with a changelog line reading only “fixed a bug that could lead to a crash” — no CVE, no advisory (The Hacker News).
• Telegram Desktop one-click account takeover (CVE-2026-107181) has a public PoC. A crafted tg:// link abuses the IPC handler to exfiltrate local files including session keys, enabling account hijack without the password; fixed in 7.2.9 (beaksec), with Chinese researchers reporting successful reproduction (write-up).
• A JPEG parsing race condition yields RCE in Discourse’s image pipeline — a nicely detailed chain from upload handling to code execution (SL Cyber).
• Pwn2Own Ireland closed at $1,262,000 for 98 zero-days. Ikotas Labs took Master of Pwn with $361,000, including the $300K top award for chaining multiple bugs on a fully patched Google Pixel 10, plus successful attempts against OpenAI Codex and the Oracle Autonomous AI Database; nobody registered for the iPhone 17 (BleepingComputer, ZDI).

New Tools & Releases

• ImmoralFiber — PoC code from the Black Hat Asia 2024 Windows Fibers research: PoisonFiber does remote Fiber enumeration and injection (into dormant Fiber objects or by hijacking FLS cleanup callbacks), PhantomThread is an evolved callstack-masking implementation. The author is explicit that the PoCs are deliberately non-evasive — RWX shellcode, CreateToolhelp32Snapshot enumeration, and ETW-TI ID 14 (WRITEVM_REMOTE) telemetry — which makes it a useful detection reference as much as an offensive one (GitHub).
• “Evil Deno” walks through the offensive-security value of the Deno runtime — permissions model, single-binary compilation and all (taggart-tech). Timely, since the Deno team is joining Cloudflare and will maintain the runtime for one more year of bug/security releases before ending development (Deno) (discussion).
• Anthropic’s OSS Scanner is live: maintainers of security-critical open-source projects can opt in via GitHub to receive automated Claude-generated vulnerability findings with explanations and suggested patches. Anthropic targets above 90% accuracy but ships reports without human review, so maintainers absorb the triage cost of any false positives (GitHub, SecurityWeek).

Threat Activity

• ClickFix has exploded, and Finnish sites are hosting it. Microsoft’s Digital Defense Report records the lure on more than 1.1 million devices in a few months of its own telemetry, with May volume 23× the level six months earlier and malware delivered in 96.3% of detected cases; NCSC-FI notes campaigns on Finnish websites after the report’s cutoff, plus the FileFix variant that uses the Explorer address bar instead of Run/PowerShell (Ilta-Sanomat). Separately, operators are buying Google Ads and abusing Bing redirects to push Claude-branded ClickFix lures (BleepingComputer).
• A legitimate Microsoft Power BI page is the first hop in a ScreenConnect delivery chain — clicking “Download Reference” opens a new tab that ends in multiple ScreenConnect instances, with the trusted domain carrying the click (Huntress).
• Wazza phishkit adds traffic filtering, session management and bot controls at the infrastructure layer, targeting banking, government and manufacturing across the US, EU and Australia (ANY.RUN via The Hacker News).
• Crypto wallet extensions, two clusters: 16 malicious Firefox add-ons impersonating Rabby and OKX intercept recovery phrases and private keys during import flows (The Hacker News), and Unit 42 found nine extensions advertised as simple utilities that render as wallets on open, targeting both hot and hardware wallets (Unit 42).
• $86M+ in suspected Ledger drains traced on-chain, with Ledger investigating a reseller serving customers in Southeast Asia. Root cause is unconfirmed — seed-phrase phishing is not ruled out, and the figure comes from independent investigator Specter, not Ledger (DailyDarkWeb).

Ransomware & Law Enforcement

• The FBI arrested the founder of a ransomware negotiation firm over alleged ShinyHunters involvement. Canadian national Edward Dubrovsky was picked up in Pennsylvania on cyber extortion and conspiracy charges, with the main complaint still sealed (KrebsOnSecurity); Director Patel frames him as a co-conspirator in the FBIJobs.gov intrusion on a third-party-managed platform (BleepingComputer), the latest in a run of arrests (earlier coverage).
• Japan’s NPA confirmed the Qilin extradition timeline: a 28-year-old Russian national was detained at an Osaka hotel in May after officials learned he planned a holiday in Japan, and handed to Germany in June over an attack on a German company (The Record; earlier coverage). Qilin’s leak-site output continues regardless — FalconFeeds reported Finnish electronics manufacturer TEPCOMP listed on 9 October.
• Deloitte has been named on The Gentlemen’s leak site, with the group threatening publication in 9–10 days. Unverified, and no scope or TTPs disclosed (Dark Web Informer).

Breaches

• Finnish hotel booking platform Vitec Hotellinx was breached through an API used for guest messaging. Names, contact details and booking dates leaked — no payment data, which isn’t stored — with the incident detected Wednesday 7 October and reportedly affecting bookings with arrival dates from 6 October onward. Victims are already getting SMS phishing containing accurate, current booking details from UK numbers; Tahko Spa, Santasport and Spa Hotel Peurunka have warned customers (Ilta-Sanomat).
• Oracle Health’s legacy Cerner breach tally has climbed to nearly 20 million people, involving stolen credentials, data theft and extortion threats (SecurityWeek).

AI & Model Security

• OpenAI’s proof dump is failing review on the specifics. Scientific American reports the Navier-Stokes result may qualify for the $1M prize only via a contested loophole — arguably the wrong problem (Scientific American) — and New Scientist found the human-readable proof and the machine-checkable formalization don’t match (New Scientist). Terence Tao has published a primer on what Lean verification does and doesn’t guarantee (Tao); @berkeleyhustle counters that the bottleneck has simply moved from generating proofs to checking them (earlier coverage) (discussion).
• OpenAI banned accounts behind Russian and Iranian influence operations. The Russian “Dark Clark” campaign ran a fake think tank, the Social Research Center, across Latin America and drew political reactions — OpenAI’s first category 5-of-6 rating; Iran’s “Bogus Bylines” used seven fabricated journalist personas to place close to 100 articles in real outlets worldwide (The Record, The Decoder).
• The three fired OpenAI safety researchers published an open letter to the Safety and Security Committee, warning that abrupt, public terminations have left staff “guessing where the line is.” Two of them — Korbak, OpenAI’s primary technical contact for METR, and Balesni — worked the Hugging Face incident investigation; OpenAI disputes their account and says it is contracting external safety auditors (The Decoder; earlier coverage).
• Claude Managed Agents can now fan out to 1,000 sub-agents under a lead agent. In Anthropic’s own bug-hunt test against a codebase with 70 seeded bugs, a single agent found at most 27 while the multi-agent workflow consistently found 66 — relevant to anyone modelling agent-driven code review or, inversely, agent-driven bug hunting (The Decoder).
• Anthropic’s updated usage policy adds account suspension for sustained abuse of Claude alongside tighter restrictions on propaganda, drone weaponization and surveillance (BBC) (discussion).

Detection & Resilience

• Seven national blue teams ran THOR at Locked Shields 2026, and Nextron published their feedback rather than testimonials — the strongest shared request was easier integration with LLM-assisted analysis of scan output (Nextron).
• Nordic public broadcasters signed the Reykjavik agreement, with RÚV, DR, NRK, SVT, SR, UR and Yle committing to joint preparedness work so news distribution survives cyberattacks, hybrid operations and disinformation campaigns (Yle).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .