zbangrec

Hudson Rock revealed that the Megalodon supply chain attack originated from information sealer infections that enabled the theft of GitHub credentials, allowing the threat actor behind the campaign to push the malicious payload.

Specifically, more than 33% of the unique usernames associated with the affected repositories -- i.e., 331 out of 978 -- have been found to be "direct matches to computers infected by infostealers," the company said. Even in scenarios where there didn't exist an exact overlap based solely on usernames, the email addresses tied to the GitHub accounts have unearthed additional stealer compromises.

"This leads us to a definitive conclusion: The affected accounts enabling the Megalodon supply chain attack are exclusively sourced from infostealer data," Hudson Rock said. "The Megalodon campaign is a stark reminder that if developers and employees are infected with infostealers, platforms like GitHub become the launchpad for devastating cascading events."

While the campaign was catalyzed by the recently open-sourced Shai Hulud framework (thanks teampcp...), the access itself came from compromised credentials from accounts that should have been revoked. By cross-referencing the usernames pushing the malware against Hudson Rock's database, we discovered that over 33% were exact matches to computers infected by infostealers. Upon deeper manual investigation, we realized that number is actually closer to 100%. (h/t OX Security & SafeDep)

Attackers are logging into these active accounts, exploiting GitHub Actions, and injecting payloads to drain AWS keys, GCP OAuth tokens, and SSH keys straight from CI/CD workflows.

While the campaign was catalyzed by the recently open-sourced Shai Hulud framework (thanks teampcp...), the access itself came from compromised credentials from accounts that should have been revoked.

By cross-referencing the usernames pushing the malware against Hudson Rock's database, we discovered that over 33% were exact matches to computers infected by infostealers. Upon deeper manual investigation, we realized that number is actually closer to 100%. (h/t OX Security & SafeDep)

Attackers are logging into these active accounts, exploiting GitHub Actions, and injecting payloads to drain AWS keys, GCP OAuth tokens, and SSH keys straight from CI/CD workflows.

Cybersecurity researchers disclosed they have detected a case of an information stealer infection successfully exfiltrating a victim's OpenClaw (formerly Clawdbot and Moltbot) configuration environment.

"This finding marks a significant milestone in the evolution of infostealer behavior: the transition from stealing browser credentials to harvesting the 'souls' and identities of personal AI [artificial intelligence] agents," Hudson Rock said.