Supply chain attacks kept the spotlight this week, from GitHub workflows to AI agents and iOS exploits. There is a clear pattern of attackers going after the tools we trust most.
Malicious GitHub Actions stealing credentials
Researchers reported that compromised maintainer accounts were used to push a credential stealing GitHub Actions workflow into over 340 repositories, including the account of pyxel author Takashi Kitao where a malicious workflow hit 27 repositories starting at 13:20 UTC. If your team pulls workflows or code from public repos, you need to review which Actions you trust and lock down who can add or change workflows in your own organisation.
The campaign was detailed by StepSecurity and shared via The Hacker News. Treat third party CI and automation as code that needs the same review and secrets hygiene as your app code.
AWS AgentCore AI agents leaking credentials
Researchers found that AWS AgentCore agents could be tricked into handing over credentials because tokens are passed in metadata, VM isolation is weak, and the agents often run with very broad permissions. If you are testing AI agents in AWS, keep them away from production accounts, strip back IAM roles, and assume anything in prompts or metadata could leak.
P7 DarkSword iOS exploit kit targets wallets and keychain
iVerify described a new P7 DarkSword iOS exploit kit variant that reduces its on device footprint, adds on device keychain and crypto wallet theft, and adds two way C2 communication with the attacker infrastructure, as reported by The Hacker News. If staff use iOS for work or hold crypto wallets on the same device, you should tighten mobile device management policies and separate personal wallets from corporate managed phones.
NCSC calls out Chinese linked supplier
The NCSC and partners published a joint advisory naming Integrity Technology and accusing it of facilitating cyber attacks for Chinese state threat actor Flax Typhoon, according to Computer Weekly. This is a reminder to review suppliers with links to high risk regions and check you are aligned with NCSC guidance on state backed threats.
Need IT support that just works? Email hello@icthero.co.uk or talk to us.