Blogs

Deepfake’s pose a Challenge as Cyber-risk Increase

The Digital world is witnessing constant increase in threats from Deepfakes, a challenge for cyber leaders as cybersecurity related risk increase and digital trust.

Deepfakes being AI generated is much used by cybercriminals with intentions to bypass authenticated security protocols and appears realistic but fakes, often posing challenges to detect being generated via AI. We have three types of Deepfakes i.e. voice fakes or Audio, Deep Video maker fakes and shallow fakes or editing software like photoshop.

Growing Cyber Risk due to Deep Fakes

Due to these Deep fakes , which are quiet easier and more realistic to create, there has been deterioration of trust, propagation of misinformation that can be used widely and has potential to damage or conduct malicious exploitation across various domains across the industry verticals.

The cybersecurity industry has always came forward and explained what can be potential risk posed by Deep fakes and possible route to mitigate the risks posed by deepfakes, emphasizing the importance of interdisciplinary collaborations between industries. This will bring in proactive measures to ensure digital authenticity and trust in the face of evolving cyber frauds.

Failing to recognize a deep fake pose negative consequence both for individuals and organizational risk and this can be unable to recognize audio fakes or video fakes. The consequences can be from loss of trust to disinformation. From negative media coverage to falling prey to potential lawsuits and other legal ramifications and we cannot undermine cybersecurity related threats and phishing attacks.

There are case when Deep fakes have been ethically used but the numbers are less compare to malicious usage by cyber criminals. Synthetic media also termed as Deep fakes are created using deep learning algorithms, particularly generative adversarial networks (GANs).

These technologies can seamlessly swap faces in videos or alter audio, creating hyper-realistic but fabricated content. In creative industries, deepfakes offer capabilities such as virtual acting and voice synthesis.

Generative Adversarial Networks (GANs) consists of two neural networks: a generator and a discriminator.

Generator: In this case the network creates synthetic data, such as images or videos from any random sound alert and mimic real data.

Discriminator generally evaluates the generated content against real data.

Deepfakes uses deep learning algorithms to analyze and synthesize visual and audio content which are painful task to determine the real ones, posing significant challenge to ethical security concerns.

While posing threats Deep fakes also provide another gateway for cyber attack specifically Phishing attacks. Tricking victims or impersonating an individual or an entity may open doors for revealing sensitive information and threat to data security.
The audios created via Deepfake could be used to bypass voice recognition systems giving attackers access to secure systems and invading personal privacy.

Uses cases in Deepfakes to understand the reach and impact:

Scammers and Fraudsters can benefit as Deepfakes can develop audio replication and use them for malicious intent like asking financial help from individuals they encounter or voice clone as some important person and demand or extort money.

Identity Theft is often overlooked and this impacts mostly financial institutions and scammers can easily bypass such authentication by cloning voices. Scammers also may easily develop convincing replicas of government ID proofs to gain access to business information or a misuse it as a customer.

Fusing images of high profile public figures with offensive images by employing deepfake technology without their knowledge by criminals and hackers are growing each day . This kind of act can eventually lead to demanding money by cyber criminals or face consequences leading to defaming.

Conspiracy against governments or national leaders by faking their image or creating false hoax where the image or voice is used by cyber criminals often hired by opposing systems in place to disturb peace and harmony and also sound business operations.

Email are the key entry point for cyberattacks and presently we see deepfake technology being used by cyber criminals to create realistic phishing emails. These emails bypass conventional security filters an area we cannot afford to neglect.

How will you detect Deep fakes?

Few technicalities are definitely there that may not be recognizable but there are few minute and hairsplitting details.

In Video fakes its often seen no movement in the eye or unnatural facial expression. The skin colour may be sightly different and in-consistent body positioning including the mismatch lip-syncing and body structure and face structure not similar as what we used to witness or accustomed viewing.

Being a grave concern from cyber security perspective its important to remain alert on new evolving technologies on Deep fakes and know their usage to defend on all frontiers both at individual and organizational level.

As Deep fakes are AI driven and rising phishing attacks that imbibe deep fakes pose a challenge where in mostly social media profile are used. The available AI-enabled computers allow cybercriminals to use chatbots no body can detect as fake.

Mitigating the Digital Threat

Organizations or individuals require robust security measures to implement AI-based security solutions and develop improved knowledge of phishing methods in order to tackle the digital threat.

Remaining proactive in all level of cyber security to navigate the complex challenge of Deep fakes is important, while Deep fakes defiantly poses strong technical challenge but proactive cybersecurity practices can stop cybercriminals from luring victims in their trap.

Government bodies and tech institutions or organizations that are tech savy to have more collaborative efforts to recognize deep fakes and effectively deal with challenges.
The various regulations and more recently the DORA (Digital Operational Resilience Act ), will help navigate these challenges as more investments in open sources security will rise by countries and organizations.

Major investments in AI-driven detection tools are being soughed after at enterprise level, those having stronger authentication mechanisms and improved digital literacy are critical to mitigating these emerging threats.

Investing in Email security service that offers automated protection will assist in blocking major phishing attempts
As per KPMG report, Deepfakes may be growing in sophistication and appear to be a daunting threat. However, by integrating deepfakes into the company’s cybersecurity and risk management, CISOs in assosiations with CEO, and Chief Risk Officers (CRO) – can help their companies stay one step ahead of malicious actors.

This calls for a broad understanding across the organization of the risks of deepfakes, and the need for an appropriate budget to combat this threat.

If Deepfakes can be utilized to infiltrate an organization, the same technology can also protect it. Collaborating with deepfake cybersecurity specialists helps spread knowledge and continually test and improve controls and defenses, to avoid fraud, data loss and reputational damage.

BISO Analytics:

We at Intruceptlabs have a mission and that is to protect your organization from any cyber threat keeping confidentiality and integrity intact.

We have BISO Analytics as a service to ensure business continues while you remain secured in the world of cybersecurity. BISO’s translates concepts and connects the dots between cybersecurity and business operations and functions are in synch with cyber teams.

Sources: https://kpmg.com/xx/en/our-insights/risk-and-regulation/deepfake-threats.html

AI-Driven Phishing And Deep Fakes: The Future Of Digital Fraud

Intruder Alert! Security Breach Leading to Data Breach

Recently 2.9 billion records of data stolen in cyber breach from National Public Data that includes Social Security numbers. Cyber experts assume that sensitive information including Social Security numbers for millions of people could be in the hands of a hacking group.

Reports suggest that after the breach occurred the data may have been released on an online marketplace or dark web.

What does this mean and how does organizations fight to save their clients and brand value?

It is a big question and something that can give restlessness to CISO’s and security teams. The results of breach remains for months and the impact too. This can result in financial losses and if hackers can have unauthorized access to online accounts or financial documents, the result is far reaching.

What it can do is first damage the brand value and result in expenses incurred from investigations.

This include legal fees for lawyers and if suit is bought by any customer or client and goes up to customer notification including compensation, fines.

Loosing brand value due to breach affects regaining the confidence of customers or partners and clients. This is long term as chance of possible loss of business opportunities and lasting reputational damage exist.

Gaining unauthorized access to a device or system leads to security breach and that leads to data breach or other malicious activity and as we know the devastating consequences for organizations at large. Now this can be defined as being over powering and surpassing all security measures that protect data or network systems of the organization including physical hardware assets.

Mostly we are accustomed with few names as

Malware: The attacker infects a system with malware that’s designed to steal sensitive data, hijack system resources.

Phishing: This technique involves a seemingly legitimate email or text or fake websites that come in surface as a scam

Physical asset: Sometimes attackers gets involved in stealing or meddling with a piece of organizations assets if he can hold on the equipment, tool to get access in enterprise system and steal data.

Breach details of national Public Data:

The hacking group USDoD claimed it had allegedly stolen personal records of 2.9 billion people from National Public Data, according to a class-action lawsuit filed in U.S. District Court in Fort Lauderdale, Florida, reported by Bloomberg Law. The breach was believed to have happened in or around April, according to the lawsuit.

One major aspect of the breach is the data also included information about the individuals’ relatives. One of the unique aspects of the data was the longevity — the addresses spanned decades of residence, and some relatives have been deceased for as long as two decades.

In addition to neglecting to inform the victims, National Public Data has not released a public statement regarding the breach. The Los Angeles Times reported that the company responded to email inquiries with “We are aware of certain third-party claims about consumer data and are investigating these issues.” The lawsuit mentions the lack of notification as a top concern of the Plaintiff.

(Source: www.usatoday.com)

In recent years, plenty of high-profile examples of security breaches have captured public attention . One security breach that actually captured attention was the Nvidia breach in 2022.

Nvidia, a major chip manufacturer, experienced a cyberattack where up to 1TB of data was stolen, including employee credentials and proprietary information.

The impact was that Hackers demanded Nvidia remove limitations on its GPUs, and internal source code was leaked. The company had to take several security measures to mitigate further damage.

This incident proved that hackers and cybercriminals are in equal terms powerful in their methods and tactics as cyber security teams . Each hacker pushed the boundaries of what was thought possible in the cyber world and their actions have had far-reaching consequences.

They targeted financial institutions and government agencies to exposing vulnerabilities in national defense systems. These incidents have served as wake-up calls, highlighting the critical need for robust cybersecurity measures and a better understanding of digital ethics and law

Preventing security breach:

Enterprise and security teams at times may take more time to rectify or better to prevent a security breach than to resolve one after it occurs. Though not all security breaches are avoidable, applying a few tried-and-tested best practices is always on the cards.

Tips for Best practices for preventing data breaches

Data breach prevention requires a comprehensive, proactive approach and a enterprise level if ots followed its better for security measure to remain strong that are being implemented.

A secure coding principles in best practice strategy: Writing secure code involves following best practices such as avoiding hardcoded credentials, implementing input validation, and ensuring proper data encryption. This way organization can reduce vulnerabilities that attackers might exploit.
Conducting Regular security audits: Conducting penetration testing and threat modeling helps identify weaknesses in your security framework and routine security assessments to mitigate potential threats.
Implementing practices with DevSecOps: Embedding security into the SDLC ensures security considerations are addressed at every stage of development. By integrating application security testing and practices like shift left testing into software development workflows, organizations can identify and fix vulnerabilities early in the process.
Creating incident response plans: Having a clear incident response plan allows organizations to detect, contain, and mitigate security breaches more efficiently. Security teams get enough time and can respond quickly to security incidents, minimizing damage and reducing downtime.
Security training for Teams : Educating development teams on cybersecurity best practices helps them recognize threats and implement secure coding practices. Security teams should stay updated on emerging threats and modern security measures.

Protect yourself with GaarudNode from Intruceptlabs

GaarudNode is an all-in-one solution designed to empower development teams with the tools they need to secure their applications throughout the development lifecycle. By combining the power of SAST, DAST, SCA, API security, and CSPM, GaarudNode provides a comprehensive security framework that ensures your applications are built, tested, and deployed with confidence.

Our Platform:
- Identifies security flaws early in the development process by scanning source code, helping developers detect issues like insecure coding practices or logic errors.
- Tests running applications in real-time to identify vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and other runtime threats.
- Detects vulnerabilities in third-party libraries and open-source components, ensuring that your dependencies don’t introduce risks.
- Continuously tests and monitors your APIs for vulnerabilities such as authentication flaws, data exposure, and insecure endpoints.

Do connect or DM for queries

(Sources:https://www.ibm.com/think/news/national-public-data-breach-publishes-private-data-billions-us-citizens)

CISA’s Support for MITRE CVE, CWE programs Extended.

Contract extension by CISA for MITRE CVE, CWE program prevents shutdown providing sign of relief for Cybersecurity community.

The CVE Program is the primary way software vulnerabilities are tracked maintained by MITRE. Recently the contract between MITRE, a non-profit research and development group including the U.S. Department of Homeland Security (DHS) to operate the CVE program, was about to expire on April 16, 2025, with no renewal in place.

This created panic in cyber security world as the CVE Program was about to expire. The United States Cyber security and Infrastructure Security Agency (CISA), stepped in during the last minute and renewed its funding for the software-vulnerability-tracking project known as the Common Vulnerabilities and Exposures Program(CVE).

CISA ensured that the Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) programs did not lapse.

Renewal of Contract with MITRE & Last Minute Rescue by CISA

‘The contract with MITRE is being extended for 11 months said a CISA’ spokesman..The importance of CVE Program is a focal point for cybersecurity program that is provides critical data and services for digital defense and research.

During the last minute when the contract was about to expire on tuesday night, the United States Cybersecurity and Infrastructure Security Agency (CISA) renewed its funding for the longtime software-vulnerability-tracking project known as the Common Vulnerabilities and Exposures Program.

MITRE’s vice president and director of the Center for Securing the Homeland, Yosry Barsoum, said in a statement on Wednesday that “CISA identified incremental funding to keep the Programs operational.” With the clock ticking down before this decision came out, some members of the CVE Program’s board announced a plan to transition the project into new non profit entity called the CVE Foundation.

The CVE program is of prime importance for the entire cyber security community and CISA, the very reason for extending support so that there is no lapse in critical CVE services.

The extension will bring in a sense of security for cyber sec professionals, vendors, and government agencies worldwide can continue to rely on the CVE program for coordinated vulnerability tracking and response.

Since its inception, the CVE Program has operated as a US government-funded initiative, with oversight and management provided under contract.

Over the years there has been doubt among members of the CVE Board about the sustainability and neutrality of a globally relied-upon resource being tied to a single government sponsor. The foundation has also written about its concern.

The cyber security community that includes researchers and cyber professionals were relieved on Wednesday, as the news flashed about the CVE Program hadn’t suddenly ceased to exist as the result of unprecedented instability in US federal funding.

Not only the US but every organization and every security tool is dependent on the CVE program and despite CISA’s last-minute funding, the future of the CVE Program is still unclear.

What makes the CVE program vital for cyber-security community?

Considering the importance of the CVE program, it should be fully funded to conduct job meant for its mission and well resourced.

On its 25th anniversary, the CVE Program continues playing vital role in global cybersecurity by identifying, defining, and cataloging publicly disclosed vulnerabilities. There is one CVE Record for each vulnerability in the catalog.

The vulnerabilities are discovered, then assigned and published by organizations globally that have partnered with the CVE Program

Lets wait for the 11 months contract funding that has been extended by CISA. Still the question remains about sustainability and neutrality of having a prominent globally recognized resource like CVE tied to a single government sponsor.

Sources: CISA Provides Last-Minute Support to Keep CVE Program Running

https://www.wired.com/story/cve-program-cisa-funding-chaos

DDoS Attacks on Critical Infrastructure Re-shaping Geopolitical Conflicts

DDoS Attacks on Critical Infrastructure Reshaping Geopolitical Conflicts

Android Malware Crocodilus; Threat for cryptocurrency wallet Users

Crocodilus is a new banking malware that evades detection from Google’s play protect.

The Android malware has been specifically targeting to steal sensitive cryptocurrency wallet credentials through social engineering. Its convincing overlay screen warns users to back up their wallet key within 12 hours or risk losing access says security researchers.

Why threat researchers call this trojan ?

Crocodilus includes all the necessary features of modern banking malware: overlay attacks, keylogging, remote access, and “hidden” remote control capabilities. Also the malware is distributed via a proprietary dropper that bypasses Android 13 (and later) security protections as per researchers of Threat fabric.

Unlike any banking trojan which takes over devices, Crocodilus is similar in pattern and uses tactics to load a fake overlay on top of the real app to intercept the victim’s account credentials. These are targeted mostly for banking or cryptocurrency app users.

Another data theft feature of Crocodilus is a keylogger and the malware monitors all Accessibility events and captures all the elements displayed on the screen, i.e. it is an accessibility Logger.

Intricacies of Crocodilus Malware

The modus operandi of the malware makes it easier to preform task to gains access to accessibility service, to unlock access to screen content, perform navigation gestures, monitor for app launches.

The malware also offers remote access Trojan (RAT) functionality, which enables its operators to tap on the screen, navigate the user interface, perform swipe actions.

The malware is fitted with dedicated RAT command to take a screenshot of the Google Authenticator application and capture one-time password codes used for two-factor authentication account protection.

Android users are advised to avoid downloading APKs from outside Google Play and to ensure that Play Protect is always active on their devices.

Researchers discovered source code of malware revealing debug messages left by the developer(s), reveal Turkish speaking.

The Expanding Threat landscape with evolving Modern Malware’s

The Crocodilus malware designed to go after high valued assets that targets cryptocurrency wallets and Banks. These malware can make the defense line up of banking system weak and researchers advise to adopt a layered security approach that includes thorough device and behavior-based risk analysis on their customers’ devices.

Modern malware has the capability to break the security defenses of organization even if they are protected by cutting edge solutions to defend. As the threat landscape expand so are sophisticated attacks rising.

Modern malware can bypass most security solutions, including email filtering, anti-virus applications, sandboxing, and even IPS/IDS and sometime few file-less malware leaves no footprint on your computer and is executed exclusively in run-time memory.

In this sophisticated war against threat criminals enterprise security requires is taking services for active threat hunting and be diligent in scanning files meant for downloads.

To improve enterprise security the important aspects needs to be covered increase usage of multi-layer defenses. Protecting against modern malware is an ongoing effort, and rarely it is “set and forget.” Utilize multiple layers of security, including anti-virus software, network layer protection, secure web gateways, and other tools for best results.

Keep improving your security posture against modern malware is an ongoing effort and includes multiple layers of security. With anti-virus software, advanced network layer protection, secure web gateways, and other tools the security posture at enterprise level increases.

Remember your best defenses can be in trouble, so continue monitoring, adapt and train employees, while using comprehensive multi-layer approach to security.

Source: https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices

Security software to represent 60% of worldwide security market; IDC

Worldwide Security Spending to Increase by 12.2% in 2025 as Global Cyberthreats Rise, Says IDC

As we witness complex and more frequent more frequent and complex cyber attacks, a rising concern for global security the spending from worldwide data projects a steady growth. The amount is staggering $377 billion by 2028 says the IDC report. This is an yr on increase of 12.2% year-on-year increase in security spending in 2025.

“Growing digital transformation and hiking emerging technology adoption across the Middle East & Africa (MEA) region — especially countries in the Gulf Cooperation Council (GCC) — have pushed the demand significantly for security solutions to face the evolving threat landscapes,” said Eman Elshewy, senior research manager with IDC Data and Analytics.

The security software market growth will be driven especially by cloud native application protection platform (CNAPP).

This also includes Identity and access management software

security analytics software growth, reflecting the special focus that companies will put on integrated cyberthreats detection and response around their whole organizational perimeter.

Key points on security software market growth

Security services will be the second fastest growing technology group in 2025,
This is driven by the continuous expansion of managed security services and growths of organizations of all size are included in it. Security hardware will rank third, achieving single-digit but steady growth in 2025.
This also include the Banking, federal/central government, telecommunications, capital markets, and healthcare provider will be the industries spending the most at the global level on security in 2025.

While the fastest-growing will be capital markets, media and entertainment, and life sciences with an expected year-on-year growth rate of 19.4%, 17.1%, and 16.9%, respectively in 2025.

Organisations developing software’s will develop their strategies based on national and international regulations that still play an important role in guiding organizations’ security strategies — especially in regulated industries .

Cause of rise in the market demand .

The rising malware including virus and Trojan horses are increasing the capacity of cyber criminal and their sophistication in attacks. Cybercriminals deploy attack and employ malware that can take control of devices. With BOYD things are more complicated.

We cannot deny how AI is giving companies a competitive edge and help to fuel more sustainable growth. Forrester predicted that IT services and software will account for nearly two-thirds of global tech spending and, in Europe and North America, this share will be even higher.

A greater drive for, and increased investment in, cybersecurity will underpin the rise in software spend, says Forrester.

In particular, this includes the updating and modernization of legacy and outdated enterprise systems to better protect organisations in the rapidly evolving threat landscape.

While large and very large businesses account for the majority of security spending across all regions, small and medium-sized businesses will continue to increase their investments in security throughout the forecast period to address security gaps and protect their assets and processes as their digital transformation accelerates.

Fig 1 Represent the state of security spending 2025

Organizations still lack the internal expertise, to properly assess or address the security implications of this shift. Cyber criminals are making these threats more sophisticated, which is adding to the urgency. IDC says this steady climb in spending will continue through 2028, hitting $377 billion by then.

Now with IDC research finding reveal investments in security throughout the forecast period to address security gaps and protect organizational assets and processes as their digital transformation accelerates.

Organisations are moving from being secure to being cyber resilient

Right now, business of every models are almost uniformly reliant on digital technology and any disruption here seriously impacts operations and revenue. Cyber criminals are on look out for every scope to launch stealthies attack.

Almost all security strategies often focus on proactively identifying and mitigating threats. Now at this hour as we stand in 2025 we need greater focus on cyber resilience.

Adopting a holistic approach in cyber security is walking the path of cyber resilience and we at Intruceptlabs working in tandem to weave the fabric of security in every workflow that supports this agility.

Recently IntruceptLabs won the Elevate 2024 Program, founded with the mission of “Making applications & digital space safer for businesses,” is encouraging for us as an organization for a cyber resilient future.

Sources: https://www.idc.com/getdoc.jsp?containerId=prEUR253264525

Coinbase Identified as Primary Target in GitHub Action supply chain attack

Recently the attack on Coinbase by bad actors and targeting their agentkit project revealed that attackers are active in crypto community. The attackers gained right to access to the repository after obtaining a GitHub token with sufficient permissions.

As per researchers from at Palo Alto Networks’ Unit 42 and Wiz, attackers compromised continuous integration/continuous delivery (CI/CD) pipelines of thousands of repositories, putting them at risk.

The attack failed and highlighted the constant threats against crypto projects happening and in this case the aim was on the Coinbase project, get access to exchange ecosystem and steal crypto assets. On time Coinbase took handle of the incident that could have led attacker to change approach to a large-scale attack and compromise many projects.

As per Reuters, 2025 the crypto industry has suffered a series of thefts, prompting questions about the security of customer funds, with hacking amount more than $2 billion in 2024 – the fourth straight year where proceeds have topped more than $1 billion.

Details of the attack methodology

According to cybersecurity firm Wiz, its analysis of GitHub identities used in the attack shows that the attacker is active in the crypto community and likely operates from Europe or Africa.

The attack exploited vulnerabilities in popular GitHub Actions, leading to the potential exposure of sensitive CI/CD secrets across numerous projects.

The attack involved the compromise of the review dog/action-setup@v1 GitHub Action.

A total of 218 repositories were confirmed to have exposed secrets, despite over 23,000 using the affected action. The payload was focused on exploiting the public CI/CD flow of one of their open source projects – agentkit, probably with the purpose of leveraging it for further compromises. However, the attacker was not able to use Coinbase secrets or publish packages.

After this initial attack, threat actor believed to have moved to the larger attack scenario that has since gained widespread attention globally.
As per researchers the attacker began preparing several days before reports surfaced, eventually affecting specific versions of tj-actions/changed-files and putting a significant number of repositories at risk.
The incident reflects how attackers can abuse third-party actions or dependencies to compromise software supply chains, potentially resulting in unauthorized access, data breaches and code tampering.
Attackers actions confirmed what was initially highly focused on Coinbase and expanded to all projects utilizing tj-actions/changed-files once their initial attempt failed.

The exposed secrets included GitHub tokens and other sensitive information, with some being short-lived.

“The attacker took significant measures to conceal their tracks using various techniques, such as leveraging dangling commits, creating multiple temporary GitHub user accounts, and obfuscating their activities in workflow logs (especially in the initial Coinbase attack),” Gil, Senior Research Manager at Palo Alto Networks, told The Hacker News. “These findings indicate that the attacker is highly skilled and has a deep understanding of CI/CD security threats and attack tactics.”

Overview of attack:

The attack affected only 218 were confirmed to have leaked secrets. The majority of these secrets were short-lived tokens that expire after a single workflow run. However, some repositories also exposed more sensitive credentials, including those for DockerHub, npm, and AWS.

tj-actions and reviewdog

During March 10 and March 14, 2025, an attacker successfully pushed a malicious commit to the tj-actions/changed-files GitHub repository. This commit contained a Base64-encoded payload shown in Figure 1, which prints all of the credentials that were present in the CI runner’s memory to the workflow’s log.

(Image: unit42.paloaltonetworks)

Figure 1. The malicious snippet that was introduced to tj-actions/changed-files.

The company stated that their security measures prevented any successful exploitation of the exposed secrets.

While Coinbase managed to avert significant damage, the incident serves as a reminder for organizations to strengthen their security protocols and remain vigilant against potential threats in the software supply chain.

The attacker was able to add the malicious commit (0e58ed8) to the repository by using a GitHub token with write permissions that they obtained previously. The attacker disguised the commit to look as if it was created by renovate[bot] — a legitimate user.

The commit was then added to a legitimate pull request that was opened by the real renovate[bot] and automatically merged, as configured for this workflow.

These steps enabled the attacker to infect the repository, without the activity being detected. Once the commit was merged, the attacker pushed new git tags to the repository to override its existing tags, making them all point to the malicious commit in the repository.

Coinbase as a soft target for attackers

Cryptocurrency platforms are frequent targets for cybercriminals due to their high-value assets and financial data.

Coinbase’s agentkit repository is used for blockchain AI agents, meaning any compromise could potentially be used for manipulating transactions, altering AI behavior, or gaining unauthorized access to blockchain-related systems. Researchers have witnessed a systemic risks of software supply chains, particularly in open-source ecosystems.

When a single dependency is compromised, it can have far-reaching consequences across thousands of projects. The reliance on shared libraries and GitHub Actions makes modern development more efficient but also inherently vulnerable to such cascading attacks.

The GitHub Actions supply chain attack highlights the vulnerabilities inherent in widely used automation tools.

Sources:

https://www.bleepingcomputer.com/news/security/coinbase-was-primary-target-of-recent-github-actions-breaches/

https://undercodenews.com

Click here

Deepfake’s pose a Challenge as Cyber-risk Increase

Intruder Alert! Security Breach Leading to Data Breach

CISA’s Support for MITRE CVE, CWE programs Extended.

DDoS Attacks on Critical Infrastructure Re-shaping Geopolitical Conflicts

Android Malware Crocodilus; Threat for cryptocurrency wallet Users

Security software to represent 60% of worldwide security market; IDC

Organisations are moving from being secure to being cyber resilient

Coinbase Identified as Primary Target in GitHub Action supply chain attack

Leadership role in Effective Vulnerability Management

Cyberespionage Group Blind Eagle Infects 1,600 Orgs in Colombia

DISA Unveils Data Strategy for Next 2 yrs; Focus on Strengthening Data Architecture, Governance

Recent Posts

Recent Comments

Search

Recent Comments

Recent Posts

Archives