Trellix Confirms Source Code Breach With Unauthorized Repository Access
2026-05-02T19:24:11Z•ff0205cdb7506458342e3292fe036415629edbf85ab4b9040a2a022d24480718
AccountDumplingAppSheetChinese-espionageGitHub-securityRCESSO-abuseSaaS-extortionbackdoorcredential-theftgo-moduleslocal-privilege-escalationnpmphishingpypiruby-gemssource-code-breachsupply-chain-attackthreat-actor-activityvishingwiper-ransomware
What happened
A batch of high-impact cybersecurity incidents and active campaigns was reported: Trellix confirmed unauthorized access to portions of its source-code repository; a Vietnamese-linked phishing operation (AccountDumpling) used Google AppSheet as a phishing relay to steal ~30,000 Facebook accounts; and rapid SaaS extortion groups are abusing vishing and SSO to steal data with minimal traces. Multiple supply-chain and credential‑theft campaigns continue to proliferate (malicious Ruby gems, Go modules, compromised npm/PyPI packages including PyTorch Lightning), alongside new backdoors and GitHub-fu
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- ff0205cdb7506458342e3292fe036415629edbf85ab4b9040a2a022d24480718
- Enrichment time
- 2026-05-02T19:24:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.