#threat-research on Hacker News

3 stories tagged threat-research, newest first.

Screenshot of wiz.io: Gheist campaign plants secret-dumping workflows using stolen GitHub tokens

Gheist campaign plants secret-dumping workflows using stolen GitHub tokens (wiz.io)

44 points by acossta 20 hours ago | 0 comments

Wiz Research blog post analyzing Gheist, a campaign using stolen GitHub tokens to plant workflows that dump repository secrets, with IOCs and response guidance.

github-actions supply-chain-security secrets-exfiltration github-tokens

Screenshot of orchidfiles.com: I found 10k GitHub repositories distributing Trojan malware

I found 10k GitHub repositories distributing Trojan malware (orchidfiles.com)

927 points by theorchid 4 months ago | 240 comments

A blog post describing the discovery of about 10,000 GitHub repositories distributing Trojan malware and the shared pattern used to find them with a script.

malware github trojan supply-chain-attack

Screenshot of labs.watchtowr.com: Backdooring Your Backdoors – Another $20 Domain, More Governments

Backdooring Your Backdoors – Another $20 Domain, More Governments (labs.watchtowr.com)

415 points by mooreds 1 year ago | 58 comments

watchTowr Labs blog post on registering abandoned domains referenced by backdoored webshells, gaining access to compromised systems including government servers.

webshells backdoors expired-domains watchtowr

#threat-research on Hacker News

Gheist campaign plants secret-dumping workflows using stolen GitHub tokens(wiz.io)

I found 10k GitHub repositories distributing Trojan malware(orchidfiles.com)

Backdooring Your Backdoors – Another $20 Domain, More Governments(labs.watchtowr.com)

Gheist campaign plants secret-dumping workflows using stolen GitHub tokens (wiz.io)

I found 10k GitHub repositories distributing Trojan malware (orchidfiles.com)

Backdooring Your Backdoors – Another $20 Domain, More Governments (labs.watchtowr.com)