Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
2026-07-09T19:24:06Z•858c9f631e818bd804a14fe00071d55e23d744da9442abe860395fcba952cfa5
CISA-KEVCVE-2026-43499CVE-2026-48282CVE-2026-50656CVE-2026-50746Friendly-FireGhostApprovalGhostLockGigaWiperGodDamn-ransomwareHalluSquatting','ghost-phishing','eviltokens','fake-installers',PoisonXRoguePlanetUbiquitiai-coding-agentsai-securitydormant-accountsgithub-enumerationinstall-scriptsmicrosoft-defendernpm12oauth-token-compromiseransomwaresupply-chainwiper
What happened
A collection of active and emerging threats across open-source ecosystems, cloud services, endpoints, and AI tooling. Datadog warns of systematic GitHub org/repo/user enumeration using dormant ‘ghost’ accounts and compromised tokens; supply-chain risk is addressed as npm 12 disables install scripts by default. Microsoft dissected a multi-component destructive Windows backdoor (GigaWiper) and patched a Defender privilege-escalation flaw (CVE-2026-50656). Multiple high-impact vulnerabilities were disclosed or added to CISA's KEV (notably Ubiquiti CVE-2026-50746, GhostLock CVE-2026-43499, and an
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 858c9f631e818bd804a14fe00071d55e23d744da9442abe860395fcba952cfa5
- Enrichment time
- 2026-07-09T19:24:06Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.