Attacker Hijacks 4,837 GitHub Accounts to Deploy CI Secret Stealer Across 1,806 Repositories

ConnectWise Investigates Active ScreenConnect Attacks Breaching MSPs and Impacting Dozens of Organizations

ConnectWise is investigating an active malware campaign targeting managed service providers that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. Huntress discovered the campaign on November 11, 2026, identifying six compromised MSPs and 286 affected endpoints across 47 organizations, with numbers continuing to rise. Attackers leverage ScreenConnect's Run Command functionality to install unauthorized clients, enabling remote access outside legitimate MSP control, and may also compromise technician workstations through reverse-pivot techniques during sessions with infected devices. ConnectWise has advised partners to avoid interactive sessions with suspected compromised devices, review account activity, revoke sessions, reset credentials, and verify multifactor authentication. Huntress provided indicators of compromise including attacker relay IP 185.99.255.28, C2 domains, rogue client IDs such as 2588ef5c15954b10, and files like Panel-Lateral.ps1. Earlier malicious activity linked to one rogue client ID was identified in a July 2026 batch script impersonating a Social Security Administration statement.

Threat Actors Compromise Qubole IAM Credentials to Breach Multiple Customer AWS Environments

A threat actor compromised two IAM users belonging to the Qubole big data platform and abused cross-account trust relationships to access customer AWS environments. The campaign ran from October 14 to 26 and impacted dozens of organizations that had previously configured IAM roles to trust Qubole’s AWS account. Attackers used the stolen credentials to assume roles, enumerate S3 buckets, retrieve secrets from AWS Secrets Manager and SSM Parameter Store, and exfiltrate data opportunistically. Researchers from Wiz, working with Sentra and Mandiant, traced the activity after observing suspicious behavior in customer environments. The attackers employed TruffleHog to validate discovered credentials including AWS keys, Microsoft Entra ID client secrets, and Okta client credentials. No public statement has been issued by Qubole, and the exact initial access vector remains unknown. Administrators are advised to review CloudTrail logs, rotate credentials, and remove unused cross-account roles.

Allan Friedman on SBOM Evolution, AI BOMs, VEX and the Future of Software Transparency

Allan Friedman, a key figure in early SBOM policy work, joined the SecurityWeek Podcast to explain why software transparency has moved beyond compliance into operational necessity. He stressed that modern applications are assembled from layers of dependencies, open source components, third-party libraries, AI models and external data sources. The real value of an SBOM lies not in its creation but in how organizations and suppliers use the data during incidents such as Log4j-style vulnerabilities or supply-chain compromises. Friedman highlighted VEX as a critical companion that helps distinguish between the presence of a vulnerable component and actual exploitability, reducing alert fatigue. He also described the emergence of AI BOMs to document models, training data, runtime sources and agentic behaviors that traditional inventories cannot capture. The discussion covered interoperability challenges, redaction options for proprietary concerns, and the potential convergence of SBOM, cryptographic BOMs and hardware BOMs into a broader transparency ecosystem. Ultimately, Friedman framed SBOM as essential data that enables defenders to correlate dependencies with threats and make timely risk decisions.