North Korea-Linked Hackers Use GitHub as C2 Infrastructure to Attack South Korea

<p>On March 24, 2026, attackers published backdoored versions of LiteLLM to PyPI. The malware harvested cloud credentials, SSH keys, Kubernetes tokens, and pretty much everything

<p>Bitwarden serves over 10 million users and 50,000 businesses. On April 22, 2026, for exactly 93 minutes, its CLI was shipping malware.</p> <p>This was not a phishing campaign.

<p><strong>Notable Changes Observed in Malicious LNK Files Distributed by Kimsuky Group</strong></p> <p><strong>Article Summary:</strong> The North Korean Kimsuky hacker group

In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code that harvests

<h2> Linux Root Exploit (CVE-2026-31431), SAP npm Supply Chain Attack, &amp; Homelab Secrets with Infisical </h2> <h3> Today's Highlights </h3> <p>This week, a critical Linux

<p>Three incidents landed in five days this week. Different attack surfaces, different techniques, different threat actors. What they have in common is that none of them required

<p><em>This article was originally published on <a href="https://lucidshark.com/blog/trivy-supply-chain-attack-ci-cd-scanner-trust-2026" rel="noopener noreferrer">LucidShark

<h2> The risk in one paragraph </h2> <p>Every time your team deploys software to AWS, a pipeline authenticates with credentials that can modify production infrastructure. In most