[smartloader]

October 9, 2026

• "RePointing" keeps the FakeGit fleet alive without creating repos. From around 06:30 UTC on 4 October, a script edited READMEs across the 17,610-repo network for 34 hours, pushing more than 13,000 repositories in bursts of up to 2,999 an hour; in the commits Apiiro sampled, 97% touched only the README and 88% aimed the Download button at a ZIP installing SmartLoader (Apiiro, BleepingComputer). · Threat Activity

in Third NetScaler RCE in a Month Lands on the Same SAML Surface

July 21, 2026

• The FakeGit campaign is spreading SmartLoader through roughly 7,600 GitHub repositories masquerading as legitimate projects. The Hacker News. · Threat Activity & Tradecraft

in Microsoft Graph Becomes a Spy's Dead Drop as WordPress "wp2shell" Exploitation Goes Live

June 29, 2026

• vx-underground is publicly reverse-engineering the heavily Lua-obfuscated SmartLoader campaign back to working source, with de-obfuscated code posted in a gist — handy reference for analysts tracking the loader. (vx-underground) · Threat Activity

in Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week

June 27, 2026

Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer

Amazon Q Developer suffered a critical vulnerability (CVE-2026-12957, CVSS 8.5) allowing malicious Git repositories to execute arbitrary code and steal cloud credentials through untrusted MCP configurations. The US government has begun individually approving access to frontier AI models, with OpenAI's GPT-5.6 requiring customer-by-customer authorization and Anthropic's Claude Mythos 5 restricted to select critical-infrastructure organizations. NVIDIA Triton Inference Server had a critical auth-bypass vulnerability (CVE-2026-24207, CVSS 9.8) with public exploits enabling pre-auth RCE. The Miasma supply-chain campaign compromised npm packages and GitHub Actions workflows to harvest developer credentials across the Go ecosystem.