On November 9, 2026, Doctor Web documented a campaign that publishes fake security tools on GitHub which disable Windows Defender and deploy AsyncRAT, a clipper and a credential stealer — with more than 2,000 PCs already infected. Vet the provenance of any GitHub tool before you run it, even when it claims to audit or clean up a security scanner.
On October 17, 2026, SafeDep, Checkmarx and CloudSEK document the MALFEX campaign, which has been publishing npm packages since August 2023 whose nine-line JavaScript files load a DLL that injects shellcode into a Windows process. If your Windows machines install npm dependencies with native addons, audit your dependency trees and treat affected hosts as compromised.
On October 8, 2026, Apiiro revealed that the FakeGit campaign has re-activated 17,610 fake GitHub repositories distributing the SmartLoader loader, several hundred of them impersonating AI skills and MCP servers. Before installing a repo from GitHub, check the account owner and prefer official registries.
On August 30, 2026, Anthropic warned users that infostealers had stolen their active Claude sessions to consume their usage. A stolen session cookie bypasses both password and 2FA — and paid AI accounts are becoming a monetization target in their own right.
An infection chain targeting Android car head units delivers the JarService malware through DoFun’s own TWCore update app. Kaspersky attributes the operation to the MoYu group behind the BadBox botnet — the first documented malware chain built specifically for this class of device.
A new variant of the XCSSET malware compromises shared Xcode projects to infect compiled macOS applications. If you clone a repository from an infected developer, your final app ships the malware without a trace.
On July 31, 2026, the Arch Linux project disabled AUR package adoption following the malicious takeover of over 200 packages. The malware, a Rust-based infostealer with SSH worm capabilities, uses Tor for C2 and targets crypto wallets, cloud secrets, and API keys.
A self-propagating supply-chain attack named ChainDrop compromised over 1,300 packages on the npm registry on August 4, 2026. The infected packages accounted for 2 billion monthly downloads and reached organizations including Deliveroo, Qlik, and ServiceTitan. Audit your dependencies now.
