The Hacker News (@TheHackersNews)
@TheHackersNews
0 正在关注 0 粉丝
🚨 ClickFix has a new trick... the malicious payload is already sitting in your browser cache before you paste the command.
Compromised sites preload scripts disguised as PNGs, letting pasted commands bypass Windows Run's ~260-character limit and launch a multi-stage malware chain.
Read:
显示更多
Update: @SocketSecurity's threat intel team noted a possible link between this GitHub Actions attack and the recent AntV npm compromise.
Both share the same exfil domain (t.m-kosche[.]com) and appear tied to the Mini Shai-Hulud activity cluster.
Reminder: Every tag now points to malicious code.
Quick action: Pin workflows to full commit SHA only. Check yours ASAP.
显示更多
