On November 9, 2026, Doctor Web documented a campaign that publishes fake security tools on GitHub which disable Windows Defender and deploy AsyncRAT, a clipper and a credential stealer — with more than 2,000 PCs already infected. Vet the provenance of any GitHub tool before you run it, even when it claims to audit or clean up a security scanner.
On October 19, 2026, a compromised developer GitHub account replaced OVHcloud CLI binaries (v0.11.0 through v0.15.0) with a secret stealer for 94 minutes, reaching roughly 250 downloads. Turn on GitHub release immutability, sign your artifacts, and remove personal accounts from publication privileges.
On October 8, 2026, Apiiro revealed that the FakeGit campaign has re-activated 17,610 fake GitHub repositories distributing the SmartLoader loader, several hundred of them impersonating AI skills and MCP servers. Before installing a repo from GitHub, check the account owner and prefer official registries.
On August 31, 2026, between 07:35 and 21:45 UTC, an attacker compromised a Coder Cloudflare API key and redirected part of the module registry’s traffic to a malicious server that exfiltrated cloud credentials. Check your logs for coder-infra[.]com and rotate the affected secrets.
On August 30, 2026, Anthropic warned users that infostealers had stolen their active Claude sessions to consume their usage. A stolen session cookie bypasses both password and 2FA — and paid AI accounts are becoming a monetization target in their own right.
On August 5, 2026, Connor Riley Moucka, 26, pleaded guilty in a US federal court for his role in breaching Snowflake customer accounts. With accomplice John Erin Binns, he exfiltrated terabytes of data from 165 organizations by exploiting absent MFA. The verdict lands two years after the facts — the lesson for cloud teams is unequivocal.
On July 31, 2026, the Arch Linux project disabled AUR package adoption following the malicious takeover of over 200 packages. The malware, a Rust-based infostealer with SSH worm capabilities, uses Tor for C2 and targets crypto wallets, cloud secrets, and API keys.
