One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens

Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user’s GitHub token.

“Just by clicking a link, it’s possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones,” security researcher Ammar Askar said.

GitHub supports a feature called GitHub.dev that runs as a lightweight web-based source code editor in the web browser’s sandbox by launching a VS Code environment. It allows users to send pull requests and make commits.

Read more: thehackernews.com

Henderson Nevada

Datacenter

Governor approves tax breaks for Google data center in Henderson

State of Nevada Governor Paul Anderson has approved $25.2 million in tax breaks for a data center project in Henderson, Nevada, which we now know

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Security

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on

Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Security

Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost