Know what changed.
Trace why it matters.

Huntress reported an active campaign using a third-party ScreenConnect extension to push malware to at least 288 machines across 48 organizations; six MSPs and more than 286 endpoints were initially tracked. Huntress observed attackers using ScreenConnect’s remote command feature to install rogue clients, with all 288 endpoints hit within 90 minutes and about one-third compromised in the first 10 minutes.

Huntress said SCKit may attempt to transfer malware to a technician’s workstation, steal authentication cookies, and use that access to reach other machines, but it has not observed that spreading method succeed; console-takeover attempts failed in every recovered host log checked.

Aikido Security said an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to. The stealer was designed to take secrets and cloud credentials accessible to a repository’s CI workflows.

The incident links developer-account governance to CI credential boundaries, without making repository access equivalent to cloud-account control.

Maersk said it identified unauthorized access and data extraction from a local legacy system inherited through a previous acquisition; it said the affected system was secured and the investigation continued. WhiteArmor claimed responsibility for about 100 GB of stolen data from the OCF/LF Logistics platform and demanded a $5 million Bitcoin ransom with a 30-day payment deadline.

The article says a breach of an older local platform could expose business and personal information belonging to drivers, customers, and logistics partners even if Maersk’s main systems remain unaffected.