Summary
A single poisoned npm package can turn a routine Windows build into a credential heist, as the MALFEX campaign exploits the npm ecosystem to inject shellcode loaders into developer machines. Cyware highlights how attackers rotate publisher handles and use files like banner.png and setup.exe to quietly establish command execution and persistence, putting software teams at risk of silent data theft.
A critical flaw in GitLab CI/CD, tracked as CVE-2026-97229 with a CVSS score of 10.0, allows unauthenticated attackers to execute code on vulnerable servers. By slipping a specially crafted regex into CI configurations, adversaries can bypass checks and seize control, making timely patching essential for organizations relying on GitLab for development pipelines.
GhostAction is turning trusted GitHub repositories into traps by hiding credential-stealing malware in font files and triggering attacks through Visual Studio Code tasks. With 94 repositories across 66 owners compromised, the campaign exposes SSH keys and cloud tokens, threatening downstream supply chains and developer environments.
Rhysida ransomware has demanded $2 million from Anne Arundel County, Maryland, after stealing 2.6 terabytes of sensitive documents. The extortion threatens over 600,000 residents with potential data exposure and service disruption, underscoring the persistent risk ransomware poses to state and local governments.
Top Malware Reported in the Last 24 Hours
GhostAction hides stealer in GitHub fonts
GhostAction attackers have been compromising GitHub repositories by disguising credential-stealing malware as a font file and triggering it through Visual Studio Code tasks. After a developer opens a trusted workspace and allows automatic tasks, it hoovers up workstation details like usernames, hostnames, and environment variables, then performs a recursive search for credential patterns tied to services including AWS, npm, PyPI, Git, Kubernetes, Claude, and Gemini. It also targets sensitive files directly, reading RSA and Ed25519 SSH private keys in full and grabbing up to the first 3,000 characters from other credential files before sending the haul out via HTTP POST on port 8080. Reporting says it persists on systems that support it by creating a cron entry marked #ghc2 that wipes older entries before re-adding itself, while Windows systems lack the same crontab persistence path. The campaign is reported to have hit 94 repositories across 66 owners, turning routine developer workflows into a quiet route for account takeovers and downstream supply-chain abuse.
MALFEX npm packages sneak loaders into Windows
MALFEX is a campaign of malicious npm packages, including imgdecode, built to compromise Windows machines by hiding shellcode loaders inside Windows native addons. It stages its payload using specific files cited in reporting—banner.png, setup.exe, and movinlike—then downloads and decrypts them before injecting the result into dllhost.exe to run quietly. The package is described as loading a DLL that checks whether it is running in a developer terminal, then pulling encrypted shellcode from GitHub, decrypting it, and injecting it into a new process. Once running, it harvests files, credentials, and other data, and uses a WebSocket connection to a command-and-control server to execute commands and maintain persistence. Recommended guidance in the report includes blocking the malicious packages, conducting security audits of systems that use npm dependencies, and isolating systems found to be compromised.
AOMEI update servers pushed CROSSROAD backdoor
A supply-chain intrusion targeting AOMEI Technology update infrastructure delivered the CROSSROAD downloader and SHINYROAD backdoor by briefly tampering with configuration in short, hard-to-catch bursts. By redirecting legitimate update traffic to attacker-controlled servers during narrow windows, the operation made standard monitoring less likely to spot the swap in time. Google’s reporting says CROSSROAD validated the environment before staging secondary payloads, while SHINYROAD provided covert command-and-control for follow-on activity. The attackers also used the Adaptix C2 framework and a modified Radmin server backdoor, underscoring that the goal was durable remote access rather than a one-off hit. The activity ran from April to July 2026 and impacted multiple sectors globally, with recommended actions including monitoring for unauthorized network redirection or unsigned processes and conducting retrospective audits using the provided indicators.
Top Vulnerabilities Reported in Last 24 hours
GitLab bug enables login-free server takeover
A critical GitLab CI/CD vulnerability (CVE-2026-97229, CVSS 10.0) can let an unauthenticated attacker execute code on a GitLab server, turning a developer platform into an entry point for broader compromise. Rapid7’s analysis says attackers can push a malicious CI configuration containing a specially crafted regex pattern where inline comments help bypass repeat checks, ultimately leading to arbitrary command execution when the pattern is compiled. No active exploitation has been reported in the provided source. Researchers at Rapid7 published the technical analysis describing the regex and inline-comment trick used to reach execution. A fix is available in 19.2.8, 19.3.5, and 19.4.2 for GitLab CE/EE; versions prior to those releases are affected.
BeyondTrust Remote Support bug exploited
A vulnerability in BeyondTrust Remote Support (CVE-2026-102764) is already being exploited in the wild, raising the stakes for organizations that rely on remote access tooling to support users and servers. Public details are thin so far, but the Cyber Centre warns the issue could enable unauthorized access or control of systems running affected versions. Attackers are already exploiting this in the wild.The advisory underscores that defenders may have less lead time because the exploitation method has not been publicly described, making timely updates central to risk reduction. BeyondTrust says affected deployments include versions prior to or equal to 26.2.3; BeyondTrust security advisories should be monitored for update guidance.
BlockStrap flaw threatens Magento storefronts
A critical weakness dubbed BlockStrap in Magento and Adobe Commerce (CVE-2026-103849) can allow attackers to run arbitrary PHP code on vulnerable e-commerce servers, potentially exposing customer data and disrupting online sales. Sansec says the bug stems from improper neutralization of special elements in a template engine, enabling a second-pass directive injection that can translate into code execution. No active exploitation has been reported in the provided source, but mass attack waves are expected soon. Researchers at Sansec flagged the issue and criticized the vendor severity prioritization while warning the exploit path can be reverse-engineered into working attacks quickly. The affected scope includes Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3; Adobe has released an October 2026 update and an isolated patch.
Top Threat Actors Reported in Last 24 hours
MALFEX booby-traps npm Windows builds
MALFEX is a supply-chain campaign abusing the npm ecosystem to plant Windows malware inside developer workflows, using packages such as imgdecode. They published and rotated multiple packages, and the activity is tied to npm publisher handles malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4. The campaign hides shellcode loaders in Windows native addons and uses files like banner.png, setup.exe, and movinlike to pull down, decrypt, and run the payload. For teams building software with npm dependencies, the consequence is stark: a single poisoned package can turn a normal install into credential and data theft from a trusted workstation. The malware ultimately injects into dllhost.exe and establishes command execution and persistence via a WebSocket C2 channel, according to reporting by The Hacker News.
GhostAction booby-traps GitHub repos via VS Code
GhostAction is a malware campaign targeting developers by quietly altering GitHub repositories so credential theft runs through everyday tooling. They compromised 94 repositories belonging to 66 owners, embedding the trigger in .vscode/tasks.json while disguising a second-stage payload as the font file public/fonts/fa-solid-400.woff2. The trap relies on Visual Studio Code behavior: execution requires the repo to be treated as a trusted workspace and the user to allow automatic tasks, turning a routine project open into a workstation compromise. For engineering teams, that can mean stolen SSH keys and cloud/dev tokens that attackers can reuse to spread into build systems and production environments. The stolen data is exfiltrated via HTTP POST on port 8080, and persistence is maintained with a cron job marked #ghc2, as described in the GBHackers report.
Rhysida extorts Maryland county for $2M
Rhysida is a ransomware gang focused on financial extortion, and they have claimed responsibility for an August attack on Anne Arundel County, Maryland. They say they stole 2.6 terabytes of documents and are threatening to leak the data unless the county pays a $2 million ransom. For the county’s more than 600,000 residents—and the agencies and services that rely on local government systems—the immediate risk is disruption paired with potential exposure of sensitive records. The incident also lands amid a wider rise in attacks against state and local governments, reinforcing the need for organizations in this sector to factor increased ransomware targeting into their cybersecurity strategy, according to The Record.
Frequently Asked Questions
What is GhostAction? GhostAction attackers have been compromising GitHub repositories by disguising credential-stealing malware as a font file and triggering it through Visual Studio Code tasks. After a developer opens a trusted workspace and allows automatic tasks, it hoovers up workstation details like usernames, hostnames, and environment variables, then performs a recursive search for credential patterns tied to services including AWS, npm, PyPI, Git, Kubernetes, Claude, and Gemini.
What is MALFEX? MALFEX is a campaign of malicious npm packages, including imgdecode, built to compromise Windows machines by hiding shellcode loaders inside Windows native addons. It stages its payload using specific files cited in reporting—banner.png, setup.exe, and movinlike—then downloads and decrypts them before injecting the result into dllhost.exe to run quietly.
What is AOMEI Technology? A supply-chain intrusion targeting AOMEI Technology update infrastructure delivered the CROSSROAD downloader and SHINYROAD backdoor by briefly tampering with configuration in short, hard-to-catch bursts. By redirecting legitimate update traffic to attacker-controlled servers during narrow windows, the operation made standard monitoring less likely to spot the swap in time.
What is CVE-2026-97229? A critical GitLab CI/CD vulnerability (CVE-2026-97229, CVSS 10.0) can let an unauthenticated attacker execute code on a GitLab server, turning a developer platform into an entry point for broader compromise. Rapid7’s analysis says attackers can push a malicious CI configuration containing a specially crafted regex pattern where inline comments help bypass repeat checks, ultimately leading to arbitrary command execution when the pattern is compiled.
What is CVE-2026-102764? A vulnerability in BeyondTrust Remote Support (CVE-2026-102764) is already being exploited in the wild, raising the stakes for organizations that rely on remote access tooling to support users and servers. Public details are thin so far, but the Cyber Centre warns the issue could enable unauthorized access or control of systems running affected versions.
What is CVE-2026-103849? A critical weakness dubbed BlockStrap in Magento and Adobe Commerce (CVE-2026-103849) can allow attackers to run arbitrary PHP code on vulnerable e-commerce servers, potentially exposing customer data and disrupting online sales. Sansec says the bug stems from improper neutralization of special elements in a template engine, enabling a second-pass directive injection that can translate into code execution.
What is Rhysida? Rhysida is a ransomware gang focused on financial extortion, and they have claimed responsibility for an August attack on Anne Arundel County, Maryland. They say they stole 2.6 terabytes of documents and are threatening to leak the data unless the county pays a $2 million ransom.