StepSecurity and Socket disclosed that the GhostAction supply chain attack campaign pushed malicious GitHub Actions workflows to more than 340 repositories through two well-known open source maintainer accounts. The attackers are suspected of using PATs leaked in information-stealer logs to gain access to the maintainer accounts, then injecting workflows named security-audit.yml or github_actions_security.yml that exfiltrated data via curl over plaintext HTTP.
iVerify discloses a new variant of the DarkSword iOS exploit kit, P7 DarkSword, which adds on-device keychain and encrypted wallet data theft and supports bidirectional C2 communication with attacker infrastructure. The implant injects into the SpringBoard process, polls for commands every 15 seconds, can execute system commands, upload photos and Apple Notes data, and targets imToken wallets for data extraction. The kit has previously been used in attacks against Saudi Arabia, Turkey, Malaysia, and Ukraine.
CSA Labs Research reports that attackers used the ChatGPT Custom GPT feature to publish a malicious GPT disguised as a ChatGPT upgrade, promoted through sponsored Google search results, leading victims into a ClickFix social engineering chain, ultimately deploying a remote access trojan (RAT). Huntress discovered and disclosed the campaign, tracing at least 40 related incidents to the same Google Sites page, with two confirmed to directly originate from interactions with a Custom GPT named Plus 5.6. The infection chain includes eight stages.
A GitHub security advisory states that Hugging Face Transformers 4.49.0 through 5.8.1 has a vulnerability: when calling GenerativePreTrainedModel.load_custom_generate(), remote Python module files are fetched and cached before the user confirms trust_remote_code. Attacker-controlled custom_generate/generate.py code is written to the ~/.cache/huggingface cache directory even if the user rejects the trust prompt.
Sep 30Wed
Wednesday · 1 items
OCSA Labs Research, Anthropic Research · 3 sourcesCSA Labs Research · 3 sources · 3 reports · 1 new source in 24 hoursAttention64↑164
OpenAI disclosed and addressed a coordinated adversarial distillation campaign: the operators did not breach encryption or databases, but manipulated model interactions so that protected reasoning content was reproduced in a form visible to the requester—for example, taking encrypted reasoning from one conversation and asking the model in another conversation to decrypt and transcribe it. The activity began on July 1, with a peak of about 16,000 extraction requests on July 24–25; the related clusters were fully blocked by July 28. OpenAI noted these figures are extraction attempts and do not represent confirmed successes, and said it is uncertain whether all operators belonged to the same party, but attributed the core cluster to individuals associated with Moonshot AI. CSA Labs research notes recounted the above disclosure, noting the activity targeted hidden reasoning rather than model weights, and mentioned that Moonshot did not respond. Anthropic, in turn, alleged that DeepSeek, Moonshot, and MiniMax conducted more than 16 million interactions with Claude across about 24,000 accounts to extract model capabilities, with MiniMax exceeding 13 million, Moonshot exceeding 3.4 million, and DeepSeek exceeding 150,000, and described detection, access control, and industry collaboration measures.
Latest developments
OpenAI blocks coordinated model distillation attack activity
The Hacker NewsThe Hacker News · 
