Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

The feed describes an active and broad threat landscape, including credential theft through compromised GitHub Actions workflows and npm packages, exploitation of internet-facing flaws in AnyDesk, AhsayCBS, Citrix NetScaler, ProFTPD and other software, iOS exploit-kit activity, phishing kits, malicious browser extensions, ransomware-related fraud, and state-linked campaigns by Flax Typhoon and UAC-0099. Several stories involve active exploitation, working exploits, supply-chain compromise, data theft, or root-level remote code execution, creating significant enterprise risk.